ANALYSIS OF HFS+ STRUCTURES AND DATA RECOVERY TECHNIQUE

This article presents a structural analysis of the HFS+ file system and describes a manual data recovery technique based on direct examination of service areas of a volume. The relevance of the study is determined by the fact that HFS+ is still encountered on external drives, backup media and legacy Apple devices, while automated recovery tools do not always correctly interpret damaged metadata. The paper examines the role of the Volume Header, Catalog File parameters, the organization of catalog B-trees, leaf node layout, record offset arrays, HFSPlusCatalogKey fields and the main structures of file and folder records. A practical example demonstrates how to determine the allocation block size, calculate the physical offset of the catalog file, identify root directory records, establish object identifiers and extract file contents using extent descriptors. The proposed method is intended for work in a hex editor and does not require expensive specialized software. The results show that manual low-level analysis can be used to recover individual critical files, verify automated tool output and study the internal principles of file system organization. The technique is useful for data recovery specialists, digital forensics practitioners and system administrators working with Apple storage media.