Difference between pages "Upcoming events" and "HFS+"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Conferences)
 
m (Category:Disk file systems)
 
Line 1: Line 1:
<b>PLEASE READ BEFORE YOU EDIT THE LISTS BELOW</b><br>
+
HFS+, or Hierarchical File System Plus, is the file system designed by Apple Computer[http://www.apple.com] to supersede HFS. First introduced with Mac OS 8.1, one of the biggest differences was the lower allocation block size of 4kb, which increased performance and lowered fragmentation [http://developer.apple.com/technotes/tn/tn1121.html#HFSPlus]. It also implemented Unicode (rather than Mac proprietary formats) for naming files.
When events begin the same day, events of a longer length should be listed first.  New postings of events with the same date(s) as other events should be added after events already in the list. Please use three-letter month abbreviations (i.e. Sep, NOT Sept. or September), use two digit dates (i.e. Jan 01 NOT Jan 1), and use date ranges rather than listing every date during an event(i.e. Jan 02-05, NOT Jan 02, 03, 04, 05).<br>
+
<i>Some events may be <u>limited</u> to <b>Law Enforcement Only</b> or to a specific audience. Such restrictions should be noted when known.</i>
+
  
This is a BY DATE listing of upcoming events relevant to [[digital forensics]]. It is not an all inclusive list, but includes most well-known activities. Some events may duplicate events on the generic [[conferences]] page, but entries in this list have specific dates and locations for the upcoming event.
+
There are structurally many differences between HFS and HFS+, which are listed below[http://developer.apple.com/technotes/tn/tn1150.html#HFSPlusBasics]:
 +
<br><br>
 +
<CENTER><TABLE Border=1 cellpadding=2 cellspacing=0 width=75%>
 +
            <TR>
 +
              <TD>
 +
                  <P><B>Feature</B></p>
  
This listing is divided into three sections (described as follows):<br>
+
              </TD><TD>
<ol><li><b><u>[[Upcoming_events#Calls_For_Papers|Calls For Papers]]</u></b> - Calls for papers for either Journals or for Conferences, relevant to Digital Forensics (Name, Closing Date, URL)</li><br>
+
                  <P><B>HFS</B></p>
<li><b><u>[[Upcoming_events#Conferences|Conferences]]</u></b> - Conferences relevant for Digital Forensics (Name, Date, Location, URL)</li><br>
+
              </TD><TD>
<li><b><u>[[Training Courses and Providers]]</u></b> - Training </li><br></ol>
+
                  <P><B>HFS Plus</B></p>
 +
              </TD><TD>
 +
                  <P><B>Benefit/Comment</B></p>
 +
              </TD></TR>
  
== Calls For Papers ==
+
            <TR>
Please help us keep this up-to-date with deadlines for upcoming conferences that would be appropriate for forensic research.
+
              <TD>
 +
                  <P>User visible name</p>
 +
              </TD><TD>
 +
                  <P>Mac OS Standard</p>
 +
              </TD><TD>
 +
                  <P>Mac OS Extended</p>
  
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
              </TD><TD>
|- style="background:#bfbfbf; font-weight: bold"
+
                  <P></p>
! width="30%|Title
+
              </TD></TR>
! width="15%"|Due Date
+
            <TR>
! width="15%"|Notification Date
+
              <TD>
! width="40%"|Website
+
                  <P>Number of allocation blocks</p>
|-
+
              </TD><TD>
|2012 secau Security Congress
+
                  <P>16 bits worth</p>
|Sep 30, 2012
+
|Oct 28, 2012
+
|http://conferences.secau.org/
+
|-
+
|First International Workshop on Cloud Computing for Forensics use – IWCCF 2012 –
+
|Oct 03, 2012
+
|Oct 05, 2012
+
|http://edas.info/N12791 - http://www.wikicfp.com/cfp/servlet/event.showcfp?eventid=23756
+
|-
+
|}
+
  
See also [http://www.wikicfp.com/cfp/servlet/tool.search?q=forensics WikiCFP 'Forensics']
+
              </TD><TD>
 +
                  <P>32 bits worth</p>
 +
              </TD><TD>
 +
                  <P>Radical decrease in disk space used on large
 +
                  volumes, and a larger number of files per volume.</p>
 +
              </TD></TR>
 +
            <TR>
 +
              <TD>
 +
                  <P>Long file names</p>
  
== Conferences ==
+
              </TD><TD>
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
                  <P>31 characters</p>
|- style="background:#bfbfbf; font-weight: bold"
+
              </TD><TD>
! width="40%"|Title
+
                  <P>255 characters</p>
! width="20%"|Date/Location
+
              </TD><TD>
! width="40%"|Website
+
                  <P>Obvious user benefit; also improves
|-
+
                  cross-platform compatibility</p>
|European Symposium on Research in Computer Security
+
              </TD></TR>
|Sep 10-12<br>Pisa, Italy
+
|http://www.iit.cnr.it/esorics2012/
+
|-
+
|15th International Symposium on Research in Attacks, Intrusions and Defenses
+
|Sep 12-14<br>Vrije Universiteit, Amsterdam, The Netherlands
+
|http://www.raid2012.org/
+
|-
+
|HTCIA International Conference & Training Expo
+
|Sep 16-19<br>Hershey, PA
+
|http://www.htcia.org/index.shtml
+
|-
+
|VirusBulletin 2012
+
|Sep 26-28<br>Dallas, TX
+
|http://www.virusbtn.com/conference/vb2012/index.xml
+
|-
+
|3rd Annual Sleuth Kit and Open Source Digital Forensics Conference
+
|Oct 02-03<br>Chantilly, VA
+
|http://www.basistech.com/about-us/events/open-source-forensics-conference/2012/
+
|-
+
|International Conference on Security in Computer Networks and Distributed Systems (SNDS'12)
+
|Oct 11-12<br>Trivandrum, India
+
|http://www.snds-conference.org/
+
|-
+
|7th IEEE LCN Workshop on Security In Communication Networks
+
|Oct 22-25<br>Clearwater, FL
+
|http://www.sick-workshop.org
+
|-
+
|4th International Conference on Digital Forensics & Cyber Crime
+
|Oct 24-28<br>West Lafayette, IN
+
|http://d-forensics.org/2012/show/home
+
|-
+
|Paraben Forensic Innovations Conference
+
|Nov 03-07<br>Park City, UT
+
|http://www.pfic-conference.com/
+
|-
+
|8th International Conference on Information Assurance and Security (IAS'12)
+
|Nov 21-23<br>Sao Carlos, Brazil
+
|http://www.mirlabs.org/ias12
+
|-
+
|Forensics@NIST 2012
+
|Nov 28-30<br>Rockville, MD
+
|http://www.nist.gov/oles/forensics-2012.cfm
+
|-
+
|IEEE International Workshop on Information Forensics and Security
+
|Dec 02-05<br>Tenerife, Spain
+
|http://www.wifs12.org/index.html
+
|-
+
|28th Annual Computer Security Applications Conference (ACSAC 2012)
+
|Dec 03-07<br>Orlando, FL
+
|http://www.acsac.org
+
|-
+
|2012 secau Security Congress
+
|Dec 03-05<br>Perth, Western Australia
+
|http://conferences.secau.org/
+
|-
+
|2013 DoD Cybercrime Conference
+
|Jan 29-Feb 01<br>Louisville, KY
+
|http://www.dodcybercrime.com/
+
|-
+
|65th Annual AAFS Meeting
+
|Feb 18-23<br>Washington, DC
+
|http://www.aafs.org/aafs-2013-annual-meeting
+
|-
+
|DFRWS 2013
+
|Aug 04-07<br>Monterey, CA
+
|http://dfrws.org/2013
+
|-
+
|Regional Computer Forensics Group GMU 2012
+
|Aug 05-09<br>Fairfax, VA
+
|http://www.rcfg.org
+
|-
+
|}
+
  
==See Also==
+
            <TR>
* [[Training Courses and Providers]]
+
              <TD>
==References==
+
                  <P>File name encoding</p>
* [http://faculty.cs.tamu.edu/guofei/sec_conf_stat.htm Computer Security Conference Ranking and Statistic]
+
              </TD><TD>
* [http://www.kdnuggets.com/meetings/ Meetings and Conferences in Data Mining and Discovery]
+
                  <P>MacRoman</p>
* http://www.conferencealerts.com/data.htm Data Mining Conferences World-Wide]
+
              </TD><TD>
 +
                  <P>Unicode</p>
 +
 
 +
              </TD><TD>
 +
                  <P>Allows for international-friendly file names,
 +
                  including mixed script names</p>
 +
              </TD></TR>
 +
            <TR>
 +
              <TD>
 +
                  <P>File/folder attributes</p>
 +
              </TD><TD>
 +
                  <P>Support for fixed size attributes (FileInfo and
 +
                  ExtendedFileInfo)</p>
 +
 
 +
              </TD><TD>
 +
                  <P>Allows for future meta-data extensions</p>
 +
              </TD><TD>
 +
                  <P>Future systems may use metadata for a richer
 +
                  Finder experience</p>
 +
              </TD></TR>
 +
            <TR>
 +
              <TD>
 +
                  <P>OS startup support</p>
 +
 
 +
              </TD><TD>
 +
                  <P>System Folder ID</p>
 +
              </TD><TD>
 +
                  <P>Also supports a dedicated startup file</p>
 +
              </TD><TD>
 +
                  <P>May help non-Mac OS systems to boot from HFS
 +
                  Plus volumes</p>
 +
              </TD></TR>
 +
 
 +
            <TR>
 +
              <TD>
 +
                  <P>catalog node size</p>
 +
              </TD><TD>
 +
                  <P>512 bytes</p>
 +
              </TD><TD>
 +
                  <P>4 KB</p>
 +
 
 +
              </TD><TD>
 +
                  <P>Maintains efficiency in the face of the other
 +
                  changes. (This larger catalog node size is due to
 +
                  the much longer file names [512 bytes as opposed to
 +
                  32 bytes], and larger catalog records (because of
 +
                  more/larger fields)).</p>
 +
              </TD></TR>
 +
            <TR>
 +
              <TD>
 +
                  <P>Maximum file size</p>
 +
              </TD><TD>
 +
                  <P>2<SUP>31</SUP> bytes</p>
 +
 
 +
              </TD><TD>
 +
                  <P>2<SUP>63</SUP> bytes</p>
 +
              </TD><TD>
 +
                  <P>Obvious user benefit, especially for multimedia
 +
                  content creators.</p></td>
 +
                  </tr>
 +
</table></CENTER>
 +
<br>
 +
An HFS+ volume contains five special files:
 +
<ol>
 +
<li>
 +
Catalog file - Describes the folder and file hierarchy of the volume. It is organized as a "balanced tree" for fast and efficient searches
 +
</li>
 +
<li>Extents overflow file - Additional extents (contiguous allocation blocks allocated to forks) are stored in a b-tree in this file
 +
</li>
 +
<li>
 +
Allocation file - Specifies whether an allocation block is free (similar to $Bitmap in NTFS). This is stored in a bitmap, specifying a free allocation block with a "clear bit"
 +
</li>
 +
<li>Attributes file - Contains attribute information regarding files or folders
 +
</li>
 +
<li>
 +
Startup file - Allows computers to boot that do have built in support for HFS+ file systems
 +
</li>
 +
</ol>
 +
<br>
 +
HFS+ also implements journaling, which allows fast recovery in the case of a crash or power outage. According to Apple, "The purpose of the journal is to ensure that when a group of related changes are being made, that either all of those changes are actually made, or none of them are made."[http://developer.apple.com/technotes/tn/tn1150.html#Journal]
 +
 
 +
Apple technical notes are available for the HFS+ file system from their [http://developer.apple.com/cgi-bin/search.pl?q=HFS+&num=10&site=default_collection website].
 +
 
 +
[[Category:Disk file systems]]

Revision as of 05:51, 28 September 2008

HFS+, or Hierarchical File System Plus, is the file system designed by Apple Computer[1] to supersede HFS. First introduced with Mac OS 8.1, one of the biggest differences was the lower allocation block size of 4kb, which increased performance and lowered fragmentation [2]. It also implemented Unicode (rather than Mac proprietary formats) for naming files.

There are structurally many differences between HFS and HFS+, which are listed below[3]:

Feature

HFS

HFS Plus

Benefit/Comment

User visible name

Mac OS Standard

Mac OS Extended

Number of allocation blocks

16 bits worth

32 bits worth

Radical decrease in disk space used on large volumes, and a larger number of files per volume.

Long file names

31 characters

255 characters

Obvious user benefit; also improves cross-platform compatibility

File name encoding

MacRoman

Unicode

Allows for international-friendly file names, including mixed script names

File/folder attributes

Support for fixed size attributes (FileInfo and ExtendedFileInfo)

Allows for future meta-data extensions

Future systems may use metadata for a richer Finder experience

OS startup support

System Folder ID

Also supports a dedicated startup file

May help non-Mac OS systems to boot from HFS Plus volumes

catalog node size

512 bytes

4 KB

Maintains efficiency in the face of the other changes. (This larger catalog node size is due to the much longer file names [512 bytes as opposed to 32 bytes], and larger catalog records (because of more/larger fields)).

Maximum file size

231 bytes

263 bytes

Obvious user benefit, especially for multimedia content creators.


An HFS+ volume contains five special files:

  1. Catalog file - Describes the folder and file hierarchy of the volume. It is organized as a "balanced tree" for fast and efficient searches
  2. Extents overflow file - Additional extents (contiguous allocation blocks allocated to forks) are stored in a b-tree in this file
  3. Allocation file - Specifies whether an allocation block is free (similar to $Bitmap in NTFS). This is stored in a bitmap, specifying a free allocation block with a "clear bit"
  4. Attributes file - Contains attribute information regarding files or folders
  5. Startup file - Allows computers to boot that do have built in support for HFS+ file systems


HFS+ also implements journaling, which allows fast recovery in the case of a crash or power outage. According to Apple, "The purpose of the journal is to ensure that when a group of related changes are being made, that either all of those changes are actually made, or none of them are made."[4]

Apple technical notes are available for the HFS+ file system from their website.