File Systems - HFS+

Question 1

Reminder of MBR limitations

Answer 1

The MBR is the first sector of the physical device

MBR contains the partition table.

This allows 4 partitions of approx 4 billion sectors. This is too small.

Even the EBR s attempts to overcome this did not achieve what is necessary for file systems these days.

Solution: GPT - GUID Partition Table.
A replacement for MBR Partitioning

Question 2

GPT - GUID Partition Table

Answer 2

Replacement for MBR Partitioning

Can store partitions up to 9.4 ZB in size

They can store up to 128 entries (partitions)

Question 3

The GPT Layout

Answer 3

The GPT layout:

Primary GPT:
Proctective MBR
Entry 1
Primary GPT Header
Entry 2 Entry 3 Entry 4
Entries 5 – 128
Partition 1
Partition 2

Secondary GPT:
Remaining Partitions
Entry 1 Entry 2 Entry 3 Entry 4
Entries 5 – 128
Secondary GPT Header

The protective MBR is there to ensure that other systems do not overwrite the file systems on the GPT partitioned device as they don’t understand the GPT header (if they are older) the protective MBR tells older systems that this is a GPT partitioned system.
Then comes primary GPT header. Then entries for each partition.

After the partition entries come the actual partitions themselves. These are where the files will be found.

At the end of the device all the important GPT info is backed up.
The final sector contains a copy of the primary GPT header and prior to this all of the partition entries are found. Therefore it has a greater level of redundancy that the MBR scheme. In MBR if sector zero is lost then all the file system info is lost with it. However GPT has a copy of everything. If some is damaged then the copy will have the backup.

Question 4

HFT and HFT+ File System Summary

Answer 4

HFS and HFS+ File Systems
● HFS (Hierarchical File System) introduced in 1985.
● Standard on Apple Macintosh machines for many years
● Also used on Removable and Optical media.
● HFS+ introduced in 1998 – now the standard for all Mac OS‐X devices (inc. Ipod!

Question 5

HFT v HFT+

Answer 5

HFS and HFS+ are very similar (the differences are like those between FAT 16 and FAT 32 - mainly to do with the sizes that can be addressed)

Question 6

What are the 2 varients of HFS+

Answer 6

Two variants of HFS+ exist

– HFSJ – HFS+ with journalling functionality

– HFSX – HFS+ with journalling and case sensitive file names

**journaling is a technique used in computer file systems to ensure fault tolerance. It works by keeping track of all
changes made to the file system in a log, called a “journal,” before committing the changes themselves to disk. This makes it easier to recover from crashes and
power failures.

The case sensitivity makes it more compatible with EXT

Question 7

HFT+ Files and Folders

Answer 7

● File / Folder names
– up to 255 Unicode characters.
– File / Folder names are case‐insensitive (ex.HFSX)

● Files have two forks (may have more)
– Data Fork: Stores file contents
– Resource Fork: Resources used by the file (icons)

● Files folders uniquely identified by CNID
– CNID: Catalog Node ID.
CNID is similar to the MFT record entry number (in NTFS) or the inode number in EXT. Every file and folder in HFS has a unique CNID

● Data is stored in extents
Extents contain
– Starting Block
– Number of Blocks
File may be composed of multiple extents
Extents are similar to NTFS Run Lists

Question 8

What are the 3 HFS+ Volume Structures?

Answer 8

● Allocation File:
– Block allocation bitmap

● Catalog File:
– Similar to $MFT; Entries identified by CNID
– Catalog entry stores metadata & first 8 extents

● Extents Overflow File:
– Only used if more than 8 extents are required

Question 9

HFS Summary

Answer 9

Summary
● Hierarchical File System is Mac Standard
● Similarities between it and EXT / NTFS exist
● Volume Header provides location of all other structures
● File metadata / extents stored in the Catalog