Difference between pages "HFS+" and "Apple Safari"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
m (Category:Disk file systems)
 
 
Line 1: Line 1:
HFS+, or Hierarchical File System Plus, is the file system designed by Apple Computer[http://www.apple.com] to supersede HFS. First introduced with Mac OS 8.1, one of the biggest differences was the lower allocation block size of 4kb, which increased performance and lowered fragmentation [http://developer.apple.com/technotes/tn/tn1121.html#HFSPlus]. It also implemented Unicode (rather than Mac proprietary formats) for naming files.
+
{{Expand}}
 +
Apple Safari is the default [[Web Browser|web browser]] included with [[Mac OS X]].
  
There are structurally many differences between HFS and HFS+, which are listed below[http://developer.apple.com/technotes/tn/tn1150.html#HFSPlusBasics]:
+
== Locations ==
<br><br>
+
The Safari browser uses different locations to store different kind of information.
<CENTER><TABLE Border=1 cellpadding=2 cellspacing=0 width=75%>
+
            <TR>
+
              <TD>
+
                  <P><B>Feature</B></p>
+
  
              </TD><TD>
+
The user directory:
                  <P><B>HFS</B></p>
+
              </TD><TD>
+
                  <P><B>HFS Plus</B></p>
+
              </TD><TD>
+
                  <P><B>Benefit/Comment</B></p>
+
              </TD></TR>
+
  
            <TR>
+
On MacOS-X
              <TD>
+
<pre>
                  <P>User visible name</p>
+
/Users/$USER/Library/Safari/
              </TD><TD>
+
</pre>
                  <P>Mac OS Standard</p>
+
              </TD><TD>
+
                  <P>Mac OS Extended</p>
+
  
              </TD><TD>
+
On Windows XP
                  <P></p>
+
<pre>
              </TD></TR>
+
C:\Documents and Settings\%USERNAME%\Application Data\Apple Computer\Safari\
            <TR>
+
</pre>
              <TD>
+
                  <P>Number of allocation blocks</p>
+
              </TD><TD>
+
                  <P>16 bits worth</p>
+
  
              </TD><TD>
+
On Windows 7
                  <P>32 bits worth</p>
+
<pre>
              </TD><TD>
+
C:\Users\{user}\AppData\Roaming\Apple Computer\Safari\
                  <P>Radical decrease in disk space used on large
+
</pre>
                  volumes, and a larger number of files per volume.</p>
+
              </TD></TR>
+
            <TR>
+
              <TD>
+
                  <P>Long file names</p>
+
  
              </TD><TD>
+
The cache directory:
                  <P>31 characters</p>
+
              </TD><TD>
+
                  <P>255 characters</p>
+
              </TD><TD>
+
                  <P>Obvious user benefit; also improves
+
                  cross-platform compatibility</p>
+
              </TD></TR>
+
  
            <TR>
+
On MacOS-X
              <TD>
+
<pre>
                  <P>File name encoding</p>
+
/Users/$USER/Library/Caches/com.apple.Safari/
              </TD><TD>
+
</pre>
                  <P>MacRoman</p>
+
              </TD><TD>
+
                  <P>Unicode</p>
+
  
              </TD><TD>
+
On Windows XP
                  <P>Allows for international-friendly file names,
+
<pre>
                  including mixed script names</p>
+
C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Apple Computer\Safari\
              </TD></TR>
+
</pre>
            <TR>
+
              <TD>
+
                  <P>File/folder attributes</p>
+
              </TD><TD>
+
                  <P>Support for fixed size attributes (FileInfo and
+
                  ExtendedFileInfo)</p>
+
  
              </TD><TD>
+
On Windows 7
                  <P>Allows for future meta-data extensions</p>
+
<pre>
              </TD><TD>
+
C:\Users\{user}\AppData\Local\Apple Computer\Safari\
                  <P>Future systems may use metadata for a richer
+
</pre>
                  Finder experience</p>
+
              </TD></TR>
+
            <TR>
+
              <TD>
+
                  <P>OS startup support</p>
+
  
              </TD><TD>
+
== History ==
                  <P>System Folder ID</p>
+
The browser history is stored in a [[Property list | binary plist file]] named '''History.plist''' in the user directory.
              </TD><TD>
+
                  <P>Also supports a dedicated startup file</p>
+
              </TD><TD>
+
                  <P>May help non-Mac OS systems to boot from HFS
+
                  Plus volumes</p>
+
              </TD></TR>
+
  
            <TR>
+
This file can be viewed directly in [[Mac OS X]] by opening file in the [[Property List Editor]] program.
              <TD>
+
                  <P>catalog node size</p>
+
              </TD><TD>
+
                  <P>512 bytes</p>
+
              </TD><TD>
+
                  <P>4 KB</p>
+
  
              </TD><TD>
+
For each web site, the program records the URL visited, the date and time of the last visit, and the number of times the site has been visited.
                  <P>Maintains efficiency in the face of the other
+
                  changes. (This larger catalog node size is due to
+
                  the much longer file names [512 bytes as opposed to
+
                  32 bytes], and larger catalog records (because of
+
                  more/larger fields)).</p>
+
              </TD></TR>
+
            <TR>
+
              <TD>
+
                  <P>Maximum file size</p>
+
              </TD><TD>
+
                  <P>2<SUP>31</SUP> bytes</p>
+
  
              </TD><TD>
+
The date and time values are stored as a floating point value containing the number of seconds since Jan 1, 2001 00:00:00 UTC.
                  <P>2<SUP>63</SUP> bytes</p>
+
              </TD><TD>
+
                  <P>Obvious user benefit, especially for multimedia
+
                  content creators.</p></td>
+
                  </tr>
+
</table></CENTER>
+
<br>
+
An HFS+ volume contains five special files:
+
<ol>
+
<li>
+
Catalog file - Describes the folder and file hierarchy of the volume. It is organized as a "balanced tree" for fast and efficient searches
+
</li>
+
<li>Extents overflow file - Additional extents (contiguous allocation blocks allocated to forks) are stored in a b-tree in this file
+
</li>
+
<li>
+
Allocation file - Specifies whether an allocation block is free (similar to $Bitmap in NTFS). This is stored in a bitmap, specifying a free allocation block with a "clear bit"
+
</li>
+
<li>Attributes file - Contains attribute information regarding files or folders
+
</li>
+
<li>
+
Startup file - Allows computers to boot that do have built in support for HFS+ file systems
+
</li>
+
</ol>
+
<br>
+
HFS+ also implements journaling, which allows fast recovery in the case of a crash or power outage. According to Apple, "The purpose of the journal is to ensure that when a group of related changes are being made, that either all of those changes are actually made, or none of them are made."[http://developer.apple.com/technotes/tn/tn1150.html#Journal]
+
  
Apple technical notes are available for the HFS+ file system from their [http://developer.apple.com/cgi-bin/search.pl?q=HFS+&num=10&site=default_collection website].
+
On a Windows PC History.plist file can be opened in [[Oxygen Forensic Plist Viewer]] software.
  
[[Category:Disk file systems]]
+
The downloads history can also be found in the user directory in a binary plist file named '''Downloads.plist'''.
 +
 
 +
== Cache ==
 +
The Safari cache is stored in '''Cache.db''' in the cache directory.
 +
 
 +
This file uses the [[SQLite database format]].
 +
 
 +
== External Links ==
 +
 
 +
* [http://www.apple.com/macosx/features/safari/ Official website]
 +
* [http://www.appleexaminer.com/files/Safari_Cache.db_Revisited.pdf Safari Cache Revisited] by Sean Cavanaugh
 +
 
 +
== Tools ==
 +
* [http://jafat.sourceforge.net/ J.A.F.A.T. Archive of Forensics Analysis Tools] home of Safari Forensic Tools (SFT)
 +
 
 +
[[Category:Applications]]
 +
[[Category:Web Browsers]]

Revision as of 05:03, 22 September 2013

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Apple Safari is the default web browser included with Mac OS X.

Contents

Locations

The Safari browser uses different locations to store different kind of information.

The user directory:

On MacOS-X

/Users/$USER/Library/Safari/

On Windows XP

C:\Documents and Settings\%USERNAME%\Application Data\Apple Computer\Safari\

On Windows 7

C:\Users\{user}\AppData\Roaming\Apple Computer\Safari\

The cache directory:

On MacOS-X

/Users/$USER/Library/Caches/com.apple.Safari/

On Windows XP

C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Apple Computer\Safari\

On Windows 7

C:\Users\{user}\AppData\Local\Apple Computer\Safari\

History

The browser history is stored in a binary plist file named History.plist in the user directory.

This file can be viewed directly in Mac OS X by opening file in the Property List Editor program.

For each web site, the program records the URL visited, the date and time of the last visit, and the number of times the site has been visited.

The date and time values are stored as a floating point value containing the number of seconds since Jan 1, 2001 00:00:00 UTC.

On a Windows PC History.plist file can be opened in Oxygen Forensic Plist Viewer software.

The downloads history can also be found in the user directory in a binary plist file named Downloads.plist.

Cache

The Safari cache is stored in Cache.db in the cache directory.

This file uses the SQLite database format.

External Links

Tools