Before we begin
Test and observe
Create a 100MB HFS+ volume and list the contents
$ hdiutil create ~/hfsplus.dmg -size 100m -fs HFS+ -volname HFSPlus $ hdiutil attach ~/hfsplus.dmg $ ls -lah /Volumes/HFSPlus/ total 0 drwxr-xr-x 4 user staff 204B Apr 18 12:16 . drwxrwxrwt@ 4 root admin 136B Apr 18 12:16 .. d-wx-wx-wt 2 user staff 68B Apr 18 12:16 .Trashes drwx------ 3 user staff 102B Apr 18 12:16 .fseventsd
There is already a noticeable difference between this HFS+ volume and our previous exFAT volume. On our exFAT volume the .Trashes directory had attributes. Those attributes were stored in a ._.Trashes file on the same volume. On our HFS+ volume the .Trashes directory does not have any attributes.
Create an empty file, add attributes, list them, and print them
$ touch /Volumes/HFSPlus/engineer $ ls -l@h /Volumes/HFSPlus/engineer -rw-r--r-- 1 user staff 0B Apr 18 12:47 /Volumes/HFSPlus/engineer $ xattr -w quote1 'Building an attribute!' /Volumes/HFSPlus/engineer $ xattr -w quote2 'Spy sapping my attribute!' /Volumes/HFSPlus/engineer $ ls -l@h /Volumes/HFSPlus/engineer -rw-r--r--@ 1 user staff 0B Apr 18 12:47 /Volumes/HFSPlus/engineer quote1 22B quote2 25B $ xattr -p quote1 /Volumes/HFSPlus/engineer Building an attribute! $ xattr -p quote2 /Volumes/HFSPlus/engineer Spy sapping my attribute!
List the contents of the volume.
$ ls -lah /Volumes/HFSPlus/ total 0 drwxr-xr-x 5 user staff 238B Apr 18 12:47 . drwxrwxrwt@ 4 root admin 136B Apr 18 12:16 .. d-wx-wx-wt 2 user staff 68B Apr 18 12:16 .Trashes drwx------ 3 user staff 102B Apr 18 12:16 .fseventsd -rw-r--r--@ 1 user staff 0B Apr 18 12:47 engineer
We see another difference when compare our different volumes. We know that the empty file engineer has attributes but we do not see where they are stored. On the exFAT volume a ._engineer file would have been created and the attributes would have been stored there.
Where are the attributes stored on our HFS+ volume?
Let’s make a dd image of the volume to analyze.
$ diskutil list HFSPlus /dev/disk2 (disk image): #: TYPE NAME SIZE IDENTIFIER 0: GUID_partition_scheme +104.9 MB disk2 1: Apple_HFS HFSPlus 104.8 MB disk2s1 $ dd if=/dev/disk2 of=~/hfsplus-dd.img 204800+0 records in 204800+0 records out 104857600 bytes transferred in 1.666504 secs (62920705 bytes/sec)
Copy the dd image to your Windows workstation and add it to XWF. After cropping and drawing multiple arrows I’ve decided to upload a single screenshot. It essentially shows everything we need for this post. The image is mounted, the attributes data is visible thanks to XWF, and the contents can be seen with the data that we created.
AccessData FTK Imager
AccessData provides FTK Image for free. It’s not junk either – It’s a great tool and you should have it. You will have to go to the product download page and give some information for an active link. You can load the image created with dd in FTK Imager to view the attributes file as we did in XWF.
I would love to have an example showing how to export and view the HFS+ volume attributes file using the SIFT Workstation. Unfortunately I don’t know of an option similar to show_sys_files that works when mounting HFS+ volumes. If you know of one please let me know!
Attributes: exFAT and HFS+ Differences
- On HFS+ volumes attributes are stored in the volume attributes file.
- On supported, non-HFS+ volumes (exFAT, FAT32, etc.) OS X stores attributes in the file ._$FILENAME where $FILENAME is the name of the file which the attribute applies.
It’s worth mentioning…
I’ll have to put a hold on my posts about HFS+ volumes and specifically attributes. I wanted to have some more posts exploring them in greater detail but ran into some research that should be done in private for now. I’ll post more about attributes and some cool things you can do with them when it’s more appropriate.
Don’t worry – I’ll pick some other part of OS X to pick at. I didn’t intend for this to be an Apple-focused blog but it has been a lot of fun. I’ll stick with it for now.