From ForensicsWiki
Revision as of 18:50, 21 February 2018 by Lc (Talk | contribs) (Added CNID info and created page)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

HFS+, or Hierarchical File System Plus, is the file system designed by Apple Computer to supersede HFS. First introduced with Mac OS 8.1, one of the biggest differences was the lower allocation block size of 4kb, which increased performance and lowered fragmentation (See: Technical Note TN1121). It also implemented Unicode (rather than Mac proprietary formats) for naming files. HFSX is a variant of HSF+ that is case sensitive.

There are structurally many differences between HFS and HFS+, which are listed below (See: Technical Note TN1150).



HFS Plus


User visible name

Mac OS Standard

Mac OS Extended

Number of allocation blocks

16 bits worth

32 bits worth

Radical decrease in disk space used on large volumes, and a larger number of files per volume.

Long file names

31 characters

255 characters

Obvious user benefit; also improves cross-platform compatibility

File name encoding



Allows for international-friendly file names, including mixed script names

File/folder attributes

Support for fixed size attributes (FileInfo and ExtendedFileInfo)

Allows for future meta-data extensions

Future systems may use metadata for a richer Finder experience

OS startup support

System Folder ID

Also supports a dedicated startup file

May help non-Mac OS systems to boot from HFS Plus volumes

catalog node size

512 bytes

4 KB

Maintains efficiency in the face of the other changes. (This larger catalog node size is due to the much longer file names [512 bytes as opposed to 32 bytes], and larger catalog records (because of more/larger fields)).

Maximum file size

231 bytes

263 bytes

Obvious user benefit, especially for multimedia content creators.

An HFS+ volume contains five special files:

  1. Catalog file - Describes the folder and file hierarchy of the volume. It is organized as a "balanced tree" for fast and efficient searches.
    This B-tree contains Catalog Node IDs (CNID) entries, incremented sequentially, for every file and folder.
  2. Extents overflow file - Additional extents (contiguous allocation blocks allocated to forks) are stored in a b-tree in this file
  3. Allocation file - Specifies whether an allocation block is free (similar to $Bitmap in NTFS). This is stored in a bitmap, specifying a free allocation block with a "clear bit"
  4. Attributes file - Contains attribute information regarding files or folders
  5. Startup file - Allows computers to boot that do have built in support for HFS+ file systems

HFS+ also implements journaling, which allows fast recovery in the case of a crash or power outage. According to Apple, "The purpose of the journal is to ensure that when a group of related changes are being made, that either all of those changes are actually made, or none of them are made."[1]

Apple technical notes are available for the HFS+ file system from their website.

External Links