Difference between pages "Encase hash files" and "Webloc"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
m (EncaseHashFiles moved to Encase hash files)
 
m (forgot the main reason why I created this page, DeRez)
 
Line 1: Line 1:
'''Encase hash files''' are different from version 3 to versions 4 and 5. Both versions start with the header HASH\x0d\x0a\xff\x00.
+
This is Mac OS X's internet shortcut file, similar to the Microsoft Windows [[.URL]] file.  However, due to the heavy usage of [[AppleDouble_header_file|AppleDouble]] resources, the expected data is actually stored as metadata and not in the the expected data file location.
  
== See also ==
+
On the file system itself, the shortcut file named <code>News.webloc</code> pointing to <code>http://news.google.com</code> is actually a zero byte file.  The URL is instead stored in the <code>._News.webloc</code> file in a field with resource type '<code>url </code>'.
  
* [[EnCase]]
+
The contents of this resource file are visible with the Apple Developer Tool [http://developer.apple.com/documentation/Darwin/Reference/ManPages/man1/DeRez.1.html DeRez]
 +
 
 +
[[Category:File Formats]]

Revision as of 03:27, 4 September 2008

This is Mac OS X's internet shortcut file, similar to the Microsoft Windows .URL file. However, due to the heavy usage of AppleDouble resources, the expected data is actually stored as metadata and not in the the expected data file location.

On the file system itself, the shortcut file named News.webloc pointing to http://news.google.com is actually a zero byte file. The URL is instead stored in the ._News.webloc file in a field with resource type 'url '.

The contents of this resource file are visible with the Apple Developer Tool DeRez