Skip to content

hfsplus-forensic

Pure-Rust forensic Apple HFS+/HFSX reader — volume-header geometry, catalog B-tree directory listing, and data-fork file extraction from a byte buffer.

Built for parsing the HFS/HFS+ side of Apple hybrid optical discs and HFS+ volumes, with no unsafe and no allocations beyond the data it returns.

Install

[dependencies]
hfsplus-forensic = "0.1"

Quick start

// `volume` is the whole HFS+ volume (its header is at offset 1024).
let volume: Vec<u8> = std::fs::read("hfsplus.img")?;

if let Some(v) = hfsplus_forensic::parse(&volume) {
    println!("{:?}  {} blocks x {} bytes", v.kind, v.total_blocks, v.block_size);

    for e in hfsplus_forensic::list_root(&volume).unwrap_or_default() {
        println!("  {}  {}", if e.is_dir { "dir " } else { "file" }, e.name);
        if !e.is_dir {
            let bytes = hfsplus_forensic::read_file(&volume, e.cnid);
            println!("    {} bytes", bytes.map(|b| b.len()).unwrap_or(0));
        }
    }
}

What it parses

Capability Notes
Volume header H+ / HX signature, version, allocation block size, block counts
Root + directory listing catalog B-tree leaf walk; list_dir(parent_cnid) for any folder
File extraction data-fork extents, truncated to the logical size

Geometry and listing only; on-disk journal replay and resource-fork specifics are out of scope.

Validation

Tests run against real hdiutil-created HFS+ output — a volume header and a populated volume (HELLO.TXT / READ.ME / SUBDIR) — so the parser is checked against genuine Apple structures, not hand-built fixtures.

Part of the Security Ronin forensic toolkit. Sibling filesystem readers: ext4fs-forensic, ntfs-forensic, udf-forensic; partition maps: apm-forensic, gpt-forensic, mbr-forensic. Consumed by iso9660-forensic for Apple hybrid discs.

Privacy Policy · Terms of Service · © 2026 Security Ronin Ltd