hfs Namespace Reference

Namespaces
namespace	anonymous_namespace{hfs_attributes.cpp}
namespace	anonymous_namespace{hfs_btree.cpp}
namespace	anonymous_namespace{hfs_catalog.cpp}
namespace	anonymous_namespace{hfs_decmpfs.cpp}
namespace	anonymous_namespace{hfs_fork_io.cpp}
namespace	anonymous_namespace{hfs_unicode.cpp}

Classes
struct	BSDInfo
struct	CatalogFile
struct	CatalogFolder
struct	CatalogKey
struct	ChildEntry
struct	DecmpfsHeader
struct	ExtentsOverflowKey
struct	FinderInfo16
struct	ForkData
struct	ForkExtent
struct	HeaderRec
struct	NodeDescriptor
struct	VolumeContext
struct	VolumeHeader

Typedefs
using	NodeReader
using	LeafRecordCallback

Functions
bool	find_inline_attribute (const std::vector< unsigned char > &attributes_btree_buffer, uint32_t fileID, const std::string &attr_name, std::vector< unsigned char > &out, std::vector< std::string > &logs)
bool	parse_node_descriptor (const unsigned char *buf, NodeDescriptor &out)
bool	parse_header_rec (const unsigned char *buf, HeaderRec &out)
uint16_t	node_record_offset (const unsigned char *node_buf, uint16_t nodeSize, uint16_t numRecords, uint16_t i)
uint16_t	node_record_length (const unsigned char *node_buf, uint16_t nodeSize, uint16_t numRecords, uint16_t i)
bool	parse_catalog_key (const unsigned char *key_buf, uint32_t max_bytes, CatalogKey &out)
uint32_t	catalog_record_body_offset (const unsigned char *record_buf, uint32_t record_len)
bool	walk_btree (const HeaderRec &header, const NodeReader &read_node, const LeafRecordCallback &on_leaf, std::vector< std::string > &logs, std::string &error)
bool	parse_catalog_folder (const unsigned char *body, uint32_t body_len, CatalogFolder &out)
bool	parse_catalog_file (const unsigned char *body, uint32_t body_len, CatalogFile &out)
std::string	catalog_name_to_host (const unsigned char *utf16be_name, uint16_t name_units)
bool	is_private_data_folder_name (const unsigned char *utf16be_name, uint16_t name_units)
uint32_t	parse_inode_filename (const unsigned char *utf16be_name, uint16_t name_units)
bool	parse_decmpfs_header (const unsigned char *buf, DecmpfsHeader &out)
const char *	decmpfs_type_name (uint32_t type)
bool	decmpfs_supported (uint32_t type)
bool	decompress_xattr_zlib (const unsigned char *xattr_buf, size_t xattr_len, uint64_t expected_uncompressed_size, std::vector< unsigned char > &out, std::string &error)
bool	decompress_resource_fork_zlib (const unsigned char *rsrc_buf, size_t rsrc_len, uint64_t expected_uncompressed_size, std::vector< unsigned char > &out, std::string &error)
bool	read_fork_inline (DiskReader &reader, uint64_t volume_offset, uint32_t block_size, const ForkData &fork, uint64_t max_bytes, std::vector< unsigned char > &out, std::vector< std::string > &logs)
bool	read_fork_block_inline (DiskReader &reader, uint64_t volume_offset, uint32_t block_size, const ForkData &fork, uint64_t fork_logical_offset, unsigned char *block_buf)
bool	read_fork_full (DiskReader &reader, uint64_t volume_offset, uint32_t block_size, const ForkData &fork, const ForkData &extents_file, uint8_t forkType, uint32_t fileID, uint64_t max_bytes, std::vector< unsigned char > &extents_btree_buffer, std::vector< unsigned char > &out, std::vector< std::string > &logs)
bool	parse_fork_data (const unsigned char *buf, ForkData &out)
bool	parse_volume_header (const unsigned char *buf, VolumeHeader &out)
uint16_t	be16 (const unsigned char *p)
uint32_t	be32 (const unsigned char *p)
uint64_t	be64 (const unsigned char *p)
uint64_t	alloc_block_to_disk_offset (uint64_t volume_offset, uint32_t alloc_block, uint32_t block_size)
std::string	utf16be_to_utf8 (const unsigned char *src, size_t code_units)
std::string	nfd_to_nfc (const std::string &utf8)
std::string	hfs_filename_to_host (const unsigned char *src, size_t code_units)

Variables
constexpr uint32_t	kHFSPlusAttrInlineData = 0x10
constexpr uint32_t	kHFSPlusAttrForkData = 0x20
constexpr uint32_t	kHFSPlusAttrExtents = 0x30
constexpr int8_t	kBTLeafNode = -1
constexpr int8_t	kBTIndexNode = 0
constexpr int8_t	kBTHeaderNode = 1
constexpr int8_t	kBTMapNode = 2
constexpr uint8_t	kHFSCaseFolding = 0xCF
constexpr uint8_t	kHFSBinaryCompare = 0xBC
constexpr uint8_t	kHFSBTreeType = 0xFF
constexpr uint8_t	kUserBTreeType = 0x80
constexpr uint8_t	kReservedBTreeType = 0x00
constexpr int16_t	kHFSPlusFolderRecord = 0x0001
constexpr int16_t	kHFSPlusFileRecord = 0x0002
constexpr int16_t	kHFSPlusFolderThreadRecord = 0x0003
constexpr int16_t	kHFSPlusFileThreadRecord = 0x0004
constexpr uint32_t	kSymLinkFileType = 0x736C6E6B
constexpr uint32_t	kSymLinkCreator = 0x72686170
constexpr uint32_t	kHardLinkFileType = 0x686C6E6B
constexpr uint32_t	kHFSPlusCreator = 0x6866732B
constexpr uint16_t	kHFSFileLockedBit = 0x0001
constexpr uint16_t	kHFSThreadExistsBit = 0x0002
constexpr uint16_t	kHFSHasAttributesBit = 0x0004
constexpr uint16_t	kHFSHasSecurityBit = 0x0008
constexpr uint16_t	kHFSHasFolderCountBit = 0x0010
constexpr uint16_t	kHFSHasLinkChainBit = 0x0020
constexpr uint16_t	kHFSHasChildLinkBit = 0x0040
constexpr uint16_t	kHFSHasDateAddedBit = 0x0080
constexpr uint8_t	UF_COMPRESSED = 0x20
constexpr int	kHFSPrivateDataNameLength = 21
constexpr uint32_t	DECMPFS_MAGIC = 0x66706D63
constexpr size_t	DECMPFS_HEADER_SIZE = 16
constexpr size_t	kDecmpfsBlockSize = 64 * 1024
constexpr uint32_t	kCompressionType_None = 1
constexpr uint32_t	kCompressionType_ZlibInXattr = 3
constexpr uint32_t	kCompressionType_ZlibInRsrc = 4
constexpr uint32_t	kCompressionType_LzvnInXattr = 7
constexpr uint32_t	kCompressionType_LzvnInRsrc = 8
constexpr uint32_t	kCompressionType_LzfseInXattr = 11
constexpr uint32_t	kCompressionType_LzfseInRsrc = 12
constexpr uint8_t	kForkTypeData = 0x00
constexpr uint8_t	kForkTypeResource = 0xFF
constexpr uint16_t	HFSPLUS_SIGNATURE = 0x482B
constexpr uint16_t	HFSX_SIGNATURE = 0x4858
constexpr uint16_t	HFSPLUS_VERSION = 4
constexpr uint16_t	HFSX_VERSION = 5
constexpr uint32_t	HFSPLUS_VOLUME_HEADER_OFFSET = 1024
constexpr uint32_t	kHFSVolumeUnmountedBit = (1u << 8)
constexpr uint32_t	kHFSVolumeJournaledBit = (1u << 13)
constexpr uint32_t	kHFSVolumeSoftwareLockBit = (1u << 15)
constexpr uint32_t	kHFSRootParentID = 1
constexpr uint32_t	kHFSRootFolderID = 2
constexpr uint32_t	kHFSExtentsFileID = 3
constexpr uint32_t	kHFSCatalogFileID = 4
constexpr uint32_t	kHFSBadBlockFileID = 5
constexpr uint32_t	kHFSAllocationFileID = 6
constexpr uint32_t	kHFSStartupFileID = 7
constexpr uint32_t	kHFSAttributesFileID = 8
constexpr uint32_t	kHFSRepairCatalogFileID = 14
constexpr uint32_t	kHFSBogusExtentFileID = 15
constexpr uint32_t	kHFSFirstUserCatalogNodeID = 16

Typedef Documentation

LeafRecordCallback

using hfs::LeafRecordCallback

Initial value:

 
std::function<bool(const unsigned char* record_buf, uint16_t record_len)>

Definition at line 174 of file hfs_btree.hpp.

NodeReader

using hfs::NodeReader

Initial value:

 
std::function<bool(uint32_t node_index, std::vector<unsigned char>& out)>

Definition at line 171 of file hfs_btree.hpp.

Function Documentation

alloc_block_to_disk_offset()

uint64_t hfs::alloc_block_to_disk_offset ( uint64_t volume_offset, uint32_t alloc_block, uint32_t block_size )

inline

Definition at line 185 of file hfs_format.hpp.

                                                                {
    return volume_offset + static_cast<uint64_t>(alloc_block) * block_size;
}

References alloc_block_to_disk_offset().

Referenced by alloc_block_to_disk_offset().

be16()

uint16_t hfs::be16 ( const unsigned char * p )

inline

Definition at line 49 of file hfs_format.hpp.

                                             {
    return static_cast<uint16_t>((p[0] << 8) | p[1]);
}

References be16().

Referenced by be16(), catalog_record_body_offset(), hfs::anonymous_namespace{hfs_fork_io.cpp}::collect_overflow_extents(), find_inline_attribute(), node_record_length(), node_record_offset(), hfs::anonymous_namespace{hfs_catalog.cpp}::parse_bsd_info(), parse_catalog_file(), parse_catalog_folder(), parse_catalog_key(), hfs::anonymous_namespace{hfs_catalog.cpp}::parse_finder_info(), parse_header_rec(), parse_node_descriptor(), parse_volume_header(), and HfsRecovery::recover().

be32()

uint32_t hfs::be32 ( const unsigned char * p )

inline

Definition at line 52 of file hfs_format.hpp.

                                             {
    return (static_cast<uint32_t>(p[0]) << 24) |
           (static_cast<uint32_t>(p[1]) << 16) |
           (static_cast<uint32_t>(p[2]) << 8)  |
            static_cast<uint32_t>(p[3]);
}

References be32().

Referenced by be32(), hfs::anonymous_namespace{hfs_fork_io.cpp}::collect_overflow_extents(), decompress_resource_fork_zlib(), hfs::anonymous_namespace{hfs_btree.cpp}::descend(), find_inline_attribute(), hfs::anonymous_namespace{hfs_catalog.cpp}::parse_bsd_info(), parse_catalog_file(), parse_catalog_folder(), parse_catalog_key(), hfs::anonymous_namespace{hfs_catalog.cpp}::parse_finder_info(), parse_fork_data(), parse_header_rec(), parse_node_descriptor(), and parse_volume_header().

be64()

uint64_t hfs::be64 ( const unsigned char * p )

inline

Definition at line 58 of file hfs_format.hpp.

                                             {
    return (static_cast<uint64_t>(p[0]) << 56) |
           (static_cast<uint64_t>(p[1]) << 48) |
           (static_cast<uint64_t>(p[2]) << 40) |
           (static_cast<uint64_t>(p[3]) << 32) |
           (static_cast<uint64_t>(p[4]) << 24) |
           (static_cast<uint64_t>(p[5]) << 16) |
           (static_cast<uint64_t>(p[6]) << 8)  |
            static_cast<uint64_t>(p[7]);
}

References be64().

Referenced by be64(), parse_fork_data(), and parse_volume_header().

catalog_name_to_host()

std::string hfs::catalog_name_to_host	(	const unsigned char *	utf16be_name,
		uint16_t	name_units )

Definition at line 114 of file hfs_catalog.cpp.

                                                       {
    // Use the unicode helper from session 1: utf16be -> utf8 + NFD->NFC
    std::string nfc = hfs::hfs_filename_to_host(utf16be_name, name_units);
    // hfs_filename_to_host already strips '/', NUL and Windows reserved chars.
    // Defensive: if the result is empty (weird file), name it "_".
    if (nfc.empty()) return "_";
    // HFS+ allows colons in names (they're path separators on classic Mac);
    // they map to '/' on the POSIX side which we already block. So '/' in
    // the user-facing name on Mac actually corresponds to ':' on disk.
    // Convert any embedded ':' -> '_' as additional safety.
    std::replace(nfc.begin(), nfc.end(), ':', '_');
    return nfc;
}

References catalog_name_to_host(), and hfs_filename_to_host().

Referenced by catalog_name_to_host(), and HfsRecovery::recover().

catalog_record_body_offset()

uint32_t hfs::catalog_record_body_offset	(	const unsigned char *	record_buf,
		uint32_t	record_len )

Definition at line 131 of file hfs_btree.cpp.

                                                          {
    if (record_buf == nullptr || record_len < 8) return 0;
    const uint16_t keyLength = be16(record_buf + 0);
    const uint32_t key_total = 2u + keyLength;
    if (key_total > record_len) return 0;
    // After the key, records are aligned on a 16-bit boundary in the
    // catalog file. Round up the key end to the next even byte.
    return (key_total + 1u) & ~1u;
}

References be16(), and catalog_record_body_offset().

Referenced by catalog_record_body_offset(), hfs::anonymous_namespace{hfs_btree.cpp}::descend(), and HfsRecovery::recover().

decmpfs_supported()

bool hfs::decmpfs_supported

(

uint32_t

type

)

Definition at line 107 of file hfs_decmpfs.cpp.

                                      {
    return type == kCompressionType_ZlibInRsrc ||
           type == kCompressionType_ZlibInXattr;
}

References decmpfs_supported(), kCompressionType_ZlibInRsrc, and kCompressionType_ZlibInXattr.

Referenced by decmpfs_supported().

decmpfs_type_name()

const char * hfs::decmpfs_type_name

(

uint32_t

type

)

Definition at line 94 of file hfs_decmpfs.cpp.

                                             {
    switch (type) {
        case kCompressionType_None:         return "raw";
        case kCompressionType_ZlibInXattr:  return "zlib-xattr";
        case kCompressionType_ZlibInRsrc:   return "zlib-rsrc";
        case kCompressionType_LzvnInXattr:  return "lzvn-xattr";
        case kCompressionType_LzvnInRsrc:   return "lzvn-rsrc";
        case kCompressionType_LzfseInXattr: return "lzfse-xattr";
        case kCompressionType_LzfseInRsrc:  return "lzfse-rsrc";
        default:                            return "unknown";
    }
}

References decmpfs_type_name(), kCompressionType_LzfseInRsrc, kCompressionType_LzfseInXattr, kCompressionType_LzvnInRsrc, kCompressionType_LzvnInXattr, kCompressionType_None, kCompressionType_ZlibInRsrc, and kCompressionType_ZlibInXattr.

Referenced by decmpfs_type_name().

decompress_resource_fork_zlib()

bool hfs::decompress_resource_fork_zlib	(	const unsigned char *	rsrc_buf,
		size_t	rsrc_len,
		uint64_t	expected_uncompressed_size,
		std::vector< unsigned char > &	out,
		std::string &	error )

Definition at line 198 of file hfs_decmpfs.cpp.

                                                      {
    out.clear();
    if (rsrc_len < 16) {
        error = "resource fork too small for header";
        return false;
    }
    // Resource fork header (big-endian):
    //   __be32 dataOffset
    //   __be32 mapOffset
    //   __be32 dataLength
    //   __be32 mapLength
    const uint32_t dataOffset = be32(rsrc_buf + 0);
    // const uint32_t mapOffset  = be32(rsrc_buf + 4);
    const uint32_t dataLength = be32(rsrc_buf + 8);
    // const uint32_t mapLength  = be32(rsrc_buf + 12);
 
    if (static_cast<uint64_t>(dataOffset) + dataLength > rsrc_len) {
        error = "resource fork data section out of range";
        return false;
    }
 
    const unsigned char* data = rsrc_buf + dataOffset;
    if (dataLength < 4) {
        error = "resource fork data section too small";
        return false;
    }
 
    // First 4 bytes of the data section: __be32 stream length
    // (= dataLength - 4)
    const uint32_t streamLen = be32(data + 0);
    if (streamLen + 4u > dataLength) {
        error = "resource fork stream length inconsistent";
        return false;
    }
    const unsigned char* stream = data + 4;
 
    // Chunked stream layout (little-endian!):
    //   __le32 numChunks
    //   struct { __le32 offset; __le32 size; } chunks[numChunks]
    //   chunk bytes
    if (streamLen < 4) {
        error = "stream too small for chunk count";
        return false;
    }
    const uint32_t numChunks = le32(stream + 0);
    if (numChunks == 0 || numChunks > 1'000'000) {
        std::ostringstream m;
        m << "implausible chunk count: " << numChunks;
        error = m.str();
        return false;
    }
    // Chunk index table starts at offset 4 within stream
    const size_t chunk_table_size = static_cast<size_t>(numChunks) * 8;
    if (4u + chunk_table_size > streamLen) {
        error = "chunk table overruns stream";
        return false;
    }
    const unsigned char* chunk_table = stream + 4;
 
    // Pre-allocate output
    out.reserve(static_cast<size_t>(expected_uncompressed_size));
 
    // Decompress each chunk
    for (uint32_t i = 0; i < numChunks; ++i) {
        const uint32_t c_off  = le32(chunk_table + i * 8 + 0);
        const uint32_t c_size = le32(chunk_table + i * 8 + 4);
        if (c_off + c_size > streamLen) {
            std::ostringstream m;
            m << "chunk " << i << " out of stream bounds";
            error = m.str();
            return false;
        }
        const unsigned char* c_data = stream + c_off;
 
        // Each chunk decompresses to up to kDecmpfsBlockSize bytes
        std::vector<unsigned char> chunk_out(kDecmpfsBlockSize);
        size_t produced = 0;
        std::string ce;
        if (!inflate_chunk(c_data, c_size, chunk_out.data(),
                           chunk_out.size(), produced, ce)) {
            std::ostringstream m;
            m << "chunk " << i << ": " << ce;
            error = m.str();
            return false;
        }
        out.insert(out.end(), chunk_out.begin(), chunk_out.begin() + produced);
        if (out.size() > expected_uncompressed_size) {
            // Some files report a smaller logical size than the chunks
            // produce -- truncate.
            out.resize(static_cast<size_t>(expected_uncompressed_size));
            break;
        }
    }
 
    if (out.size() != expected_uncompressed_size) {
        std::ostringstream m;
        m << "decompressed size " << out.size()
          << " differs from expected " << expected_uncompressed_size;
        // This is a soft warning, not a fatal error: some volumes have
        // size accounting that doesn't include trailing zeros, etc.
        // We DO accept the buffer as long as it's non-empty, but log.
        error = m.str();
        // Still return true if we have nonzero bytes (caller checks
        // error and decides). Return false only on truly empty output.
        if (out.empty()) return false;
    }
    return true;
}

References be32(), decompress_resource_fork_zlib(), and kDecmpfsBlockSize.

Referenced by decompress_resource_fork_zlib(), and HfsRecovery::recover().

decompress_xattr_zlib()

bool hfs::decompress_xattr_zlib	(	const unsigned char *	xattr_buf,
		size_t	xattr_len,
		uint64_t	expected_uncompressed_size,
		std::vector< unsigned char > &	out,
		std::string &	error )

Definition at line 131 of file hfs_decmpfs.cpp.

                                              {
    out.clear();
    if (xattr_len < DECMPFS_HEADER_SIZE) {
        error = "xattr too small for decmpfs header";
        return false;
    }
    DecmpfsHeader h;
    if (!parse_decmpfs_header(xattr_buf, h)) {
        error = "decmpfs header magic mismatch";
        return false;
    }
    if (h.type != kCompressionType_ZlibInXattr) {
        error = "compression type is not zlib-xattr";
        return false;
    }
    if (h.size != expected_uncompressed_size) {
        // The catalog logical_size and the decmpfs header should agree.
        // We tolerate a mismatch (use the header value).
    }
    const unsigned char* payload = xattr_buf + DECMPFS_HEADER_SIZE;
    const size_t payload_len = xattr_len - DECMPFS_HEADER_SIZE;
    if (payload_len == 0) {
        error = "decmpfs xattr has no payload";
        return false;
    }
 
    // The 0xFF marker means "raw uncompressed data follows"
    if (payload[0] == 0xFF) {
        const size_t raw_len = payload_len - 1;
        if (raw_len < h.size) {
            // Tolerate: maybe the size declared is wrong; use what we
            // have.
            out.assign(payload + 1, payload + 1 + raw_len);
        } else {
            out.assign(payload + 1, payload + 1 + h.size);
        }
        return true;
    }
 
    // Standard zlib stream
    out.resize(static_cast<size_t>(h.size));
    z_stream zs{};
    zs.next_in = const_cast<Bytef*>(payload);
    zs.avail_in = static_cast<uInt>(payload_len);
    zs.next_out = out.data();
    zs.avail_out = static_cast<uInt>(out.size());
    int ret = inflateInit(&zs);
    if (ret != Z_OK) {
        error = "inflateInit failed";
        return false;
    }
    ret = inflate(&zs, Z_FINISH);
    if (ret != Z_STREAM_END && ret != Z_OK) {
        error = std::string("inflate failed: ") +
                (zs.msg ? zs.msg : "unknown error");
        inflateEnd(&zs);
        return false;
    }
    out.resize(static_cast<size_t>(zs.total_out));
    inflateEnd(&zs);
    return true;
}

References DECMPFS_HEADER_SIZE, decompress_xattr_zlib(), kCompressionType_ZlibInXattr, parse_decmpfs_header(), hfs::DecmpfsHeader::size, and hfs::DecmpfsHeader::type.

Referenced by decompress_xattr_zlib(), and HfsRecovery::recover().

find_inline_attribute()

bool hfs::find_inline_attribute	(	const std::vector< unsigned char > &	attributes_btree_buffer,
		uint32_t	fileID,
		const std::string &	attr_name,
		std::vector< unsigned char > &	out,
		std::vector< std::string > &	logs )

Definition at line 28 of file hfs_attributes.cpp.

                                                        {
    out.clear();
    if (attributes_btree_buffer.size() < 14) return false;
 
    // Step 1: parse the B-tree header (node 0)
    NodeDescriptor n0;
    if (!parse_node_descriptor(attributes_btree_buffer.data(), n0) ||
        n0.kind != kBTHeaderNode) {
        logs.push_back("HFS+ Attributes: node 0 is not a header node");
        return false;
    }
    HeaderRec hdr;
    if (!parse_header_rec(attributes_btree_buffer.data() + 14, hdr)) {
        logs.push_back("HFS+ Attributes: B-tree header parse failed");
        return false;
    }
 
    // Step 2: build the UTF-16BE search key (we only match by name + fileID;
    // attribute records may also have startBlock != 0 for extent
    // continuation records, but those are not Inline records)
    const auto target_name_utf16be = utf8_to_utf16be_ascii(attr_name);
 
    // Step 3: walk the tree looking for matching records
    auto node_reader = [&](uint32_t node_index,
                           std::vector<unsigned char>& nodebuf) -> bool {
        const uint64_t off = static_cast<uint64_t>(node_index) * hdr.nodeSize;
        if (off + hdr.nodeSize > attributes_btree_buffer.size()) return false;
        nodebuf.assign(attributes_btree_buffer.begin() + off,
                       attributes_btree_buffer.begin() + off + hdr.nodeSize);
        return true;
    };
 
    bool found = false;
    auto on_leaf = [&](const unsigned char* rec, uint16_t rec_len) -> bool {
        // Attribute KEY layout (after the 2-byte keyLength):
        //   __be16 pad
        //   __be32 fileID
        //   __be32 startBlock
        //   __be16 attrNameLength
        //   UTF-16BE attrName[attrNameLength]
        if (rec_len < 14) return true;
        const uint16_t keyLength = be16(rec + 0);
        if (keyLength < 12 || 2u + keyLength > rec_len) return true;
        // pad at +2
        const uint32_t rec_fileID    = be32(rec + 4);
        if (rec_fileID != fileID) return true;
        // startBlock at +8 (we want startBlock=0 for the primary record)
        const uint32_t rec_startBlock = be32(rec + 8);
        if (rec_startBlock != 0) return true;  // skip overflow records
        const uint16_t rec_nameLen = be16(rec + 12);
        if (rec_nameLen != target_name_utf16be.size() / 2) return true;
        // Compare UTF-16BE name byte-by-byte
        const size_t name_offset = 14;
        const size_t name_bytes = static_cast<size_t>(rec_nameLen) * 2;
        if (name_offset + name_bytes > 2u + keyLength) return true;
        if (std::memcmp(rec + name_offset, target_name_utf16be.data(),
                         name_bytes) != 0) return true;
 
        // Found a key match. Body starts AFTER the key, on a 2-byte
        // alignment boundary.
        const uint32_t key_total = 2u + keyLength;
        const uint32_t body_off = (key_total + 1u) & ~1u;
        if (body_off + 4 > rec_len) return true;
 
        const uint32_t recordType = be32(rec + body_off);
        if (recordType != kHFSPlusAttrInlineData) {
            // ForkData or Extents -- not supported here
            std::ostringstream m;
            m << "HFS+ Attributes: attribute '" << attr_name
              << "' on fileID " << fileID
              << " uses non-inline storage (recordType=0x"
              << std::hex << recordType << ") -- not supported";
            logs.push_back(m.str());
            return false;  // stop walk: this is the only record we expected
        }
 
        // Inline record body layout:
        //   __be32 recordType (= 0x10)        already read
        //   __be32 reserved[2]                 +4..+12
        //   __be32 attrSize                    +12
        //   attribute data[attrSize]           +16
        if (body_off + 16 > rec_len) return true;
        const uint32_t attrSize = be32(rec + body_off + 12);
        if (attrSize == 0) return false;
        if (body_off + 16 + attrSize > rec_len) {
            logs.push_back("HFS+ Attributes: inline data overruns record");
            return false;
        }
        out.assign(rec + body_off + 16, rec + body_off + 16 + attrSize);
        found = true;
        return false;  // stop walk -- we got what we wanted
    };
 
    std::vector<std::string> walk_logs;
    std::string walk_err;
    walk_btree(hdr, node_reader, on_leaf, walk_logs, walk_err);
    for (auto& l : walk_logs) logs.push_back(std::move(l));
    if (!walk_err.empty()) {
        logs.push_back("HFS+ Attributes walk: " + walk_err);
    }
    return found;
}

References be16(), be32(), find_inline_attribute(), kBTHeaderNode, kHFSPlusAttrInlineData, hfs::NodeDescriptor::kind, hfs::HeaderRec::nodeSize, parse_header_rec(), parse_node_descriptor(), and walk_btree().

Referenced by find_inline_attribute(), and HfsRecovery::recover().

hfs_filename_to_host()

std::string hfs::hfs_filename_to_host	(	const unsigned char *	src,
		size_t	code_units )

Definition at line 285 of file hfs_unicode.cpp.

                                                                            {
    auto cps = utf16be_to_codepoints(src, code_units);
    cps = compose_nfc(cps);
    std::string raw = codepoints_to_utf8(cps);
 
    // Sanitise for host filesystem: replace NUL and '/' with '_'.
    // (We don't apply Windows-specific stripping here; the project's
    // text_utils helpers handle that elsewhere. We just produce a
    // string safe for posix paths.)
    std::string out;
    out.reserve(raw.size());
    for (char c : raw) {
        unsigned char uc = static_cast<unsigned char>(c);
        if (uc == 0 || uc == '/') out.push_back('_');
        else out.push_back(c);
    }
    if (out.empty()) out = "_";
    return out;
}

References hfs_filename_to_host().

Referenced by catalog_name_to_host(), and hfs_filename_to_host().

is_private_data_folder_name()

bool hfs::is_private_data_folder_name	(	const unsigned char *	utf16be_name,
		uint16_t	name_units )

Definition at line 129 of file hfs_catalog.cpp.

                                                       {
    // Folder name on disk is 4 NUL (UTF-16) units followed by
    // "HFS+ Private Data" (17 ASCII chars).
    if (name_units != kHFSPrivateDataNameLength) return false;
    // First 4 code units (8 bytes) must be all zero.
    for (int i = 0; i < 8; ++i) {
        if (utf16be_name[i] != 0) return false;
    }
    // Remaining 17 code units must be ASCII "HFS+ Private Data"
    static const char* expected = "HFS+ Private Data";
    for (int i = 0; i < 17; ++i) {
        const unsigned char hi = utf16be_name[8 + i * 2];
        const unsigned char lo = utf16be_name[8 + i * 2 + 1];
        if (hi != 0) return false;
        if (lo != static_cast<unsigned char>(expected[i])) return false;
    }
    return true;
}

References is_private_data_folder_name(), and kHFSPrivateDataNameLength.

Referenced by is_private_data_folder_name(), and HfsRecovery::recover().

nfd_to_nfc()

std::string hfs::nfd_to_nfc

(

const std::string &

utf8

)

Definition at line 260 of file hfs_unicode.cpp.

                                            {
    // Decode UTF-8 -> code points (we assume well-formed UTF-8 since
    // it came from utf16be_to_utf8 above).
    std::vector<uint32_t> cps;
    cps.reserve(utf8.size());
    size_t i = 0;
    while (i < utf8.size()) {
        const unsigned char b = static_cast<unsigned char>(utf8[i]);
        uint32_t cp = 0;
        size_t len = 0;
        if (b < 0x80) { cp = b; len = 1; }
        else if ((b & 0xE0) == 0xC0) { cp = b & 0x1F; len = 2; }
        else if ((b & 0xF0) == 0xE0) { cp = b & 0x0F; len = 3; }
        else if ((b & 0xF8) == 0xF0) { cp = b & 0x07; len = 4; }
        else { cp = 0xFFFD; len = 1; }
        if (i + len > utf8.size()) { cps.push_back(0xFFFD); break; }
        for (size_t j = 1; j < len; ++j) {
            cp = (cp << 6) | (static_cast<unsigned char>(utf8[i + j]) & 0x3F);
        }
        cps.push_back(cp);
        i += len;
    }
    return codepoints_to_utf8(compose_nfc(cps));
}

References nfd_to_nfc().

Referenced by nfd_to_nfc().

node_record_length()

uint16_t hfs::node_record_length	(	const unsigned char *	node_buf,
		uint16_t	nodeSize,
		uint16_t	numRecords,
		uint16_t	i )

Definition at line 88 of file hfs_btree.cpp.

                                        {
    if (i >= numRecords) return 0;
    const uint16_t this_off = node_record_offset(node_buf, nodeSize,
                                                  numRecords, i);
    if (this_off == 0) return 0;
    // Next offset (which is at index i+1 in the descending table) gives
    // the END of record `i`. For i == numRecords-1, the next entry IS
    // the "free space" offset, which is the end of the records area.
    const uint32_t next_idx = static_cast<uint32_t>(nodeSize)
                            - 2u * (static_cast<uint32_t>(i) + 2u);
    if (next_idx + 2 > nodeSize) return 0;
    const uint16_t next_off = be16(node_buf + next_idx);
    if (next_off < this_off) return 0; // corrupt
    return next_off - this_off;
}

References be16(), node_record_length(), and node_record_offset().

Referenced by hfs::anonymous_namespace{hfs_btree.cpp}::descend(), and node_record_length().

node_record_offset()

uint16_t hfs::node_record_offset	(	const unsigned char *	node_buf,
		uint16_t	nodeSize,
		uint16_t	numRecords,
		uint16_t	i )

Definition at line 70 of file hfs_btree.cpp.

                                        {
    if (i >= numRecords) return 0;
    if (node_buf == nullptr) return 0;
    if (nodeSize < 14 + 2u * (static_cast<uint32_t>(numRecords) + 1)) {
        return 0;  // not enough room for offset table
    }
    // The offsets table sits at the END of the node, with one 16-bit
    // entry per record (numRecords entries) plus a "free space" offset
    // (numRecords+1 entries total). The LAST 2 bytes hold the offset
    // of record 0; the 2 before that hold record 1; and so on.
    const uint32_t off_idx = static_cast<uint32_t>(nodeSize)
                          - 2u * (static_cast<uint32_t>(i) + 1u);
    return be16(node_buf + off_idx);
}

References be16(), and node_record_offset().

Referenced by hfs::anonymous_namespace{hfs_btree.cpp}::descend(), node_record_length(), and node_record_offset().

parse_catalog_file()

bool hfs::parse_catalog_file	(	const unsigned char *	body,
		uint32_t	body_len,
		CatalogFile &	out )

Definition at line 78 of file hfs_catalog.cpp.

                                           {
    if (body == nullptr || body_len < 246) return false;
    // Body layout (after the 2-byte recordType):
    //   0x00 __be16 flags
    //   0x02 __be32 reserved1
    //   0x06 __be32 fileID
    //   0x0A __be32 createDate
    //   0x0E __be32 contentModDate
    //   0x12 __be32 attributeModDate
    //   0x16 __be32 accessDate
    //   0x1A __be32 backupDate
    //   0x1E permissions (16)
    //   0x2E userInfo (16)
    //   0x3E ExtendedFileInfo (16)
    //   0x4E __be32 textEncoding
    //   0x52 __be32 reserved2
    //   0x56 dataFork (80)
    //   0xA6 resourceFork (80)
    // Total body = 246 bytes.
    out = {};
    out.flags             = be16(body + 0x00);
    out.fileID            = be32(body + 0x06);
    out.createDate        = be32(body + 0x0A);
    out.contentModDate    = be32(body + 0x0E);
    out.attributeModDate  = be32(body + 0x12);
    out.accessDate        = be32(body + 0x16);
    out.backupDate        = be32(body + 0x1A);
    out.permissions       = parse_bsd_info(body + 0x1E);
    out.userInfo          = parse_finder_info(body + 0x2E);
    out.textEncoding      = be32(body + 0x4E);
    if (!parse_fork_data(body + 0x56, out.dataFork))     return false;
    if (!parse_fork_data(body + 0xA6, out.resourceFork)) return false;
    return true;
}

References hfs::CatalogFile::accessDate, hfs::CatalogFile::attributeModDate, hfs::CatalogFile::backupDate, be16(), be32(), hfs::CatalogFile::contentModDate, hfs::CatalogFile::createDate, hfs::CatalogFile::dataFork, hfs::CatalogFile::fileID, hfs::CatalogFile::flags, parse_catalog_file(), parse_fork_data(), hfs::CatalogFile::permissions, hfs::CatalogFile::resourceFork, hfs::CatalogFile::textEncoding, and hfs::CatalogFile::userInfo.

Referenced by parse_catalog_file(), and HfsRecovery::recover().

parse_catalog_folder()

bool hfs::parse_catalog_folder	(	const unsigned char *	body,
		uint32_t	body_len,
		CatalogFolder &	out )

Definition at line 44 of file hfs_catalog.cpp.

                                               {
    if (body == nullptr || body_len < 86) return false;
    // Body layout (after the 2-byte recordType already consumed):
    //   0x00 __be16 flags
    //   0x02 __be32 valence
    //   0x06 __be32 folderID
    //   0x0A __be32 createDate
    //   0x0E __be32 contentModDate
    //   0x12 __be32 attributeModDate
    //   0x16 __be32 accessDate
    //   0x1A __be32 backupDate
    //   0x1E HFSPlusBSDInfo permissions (16)
    //   0x2E userInfo (16)
    //   0x3E ExtendedFolderInfo (16) -- skipped
    //   0x4E __be32 textEncoding
    //   0x52 __be32 reserved
    // Total body = 86 bytes (not 88 -- the 2 bytes of recordType are
    // separate from this "body" view).
    out = {};
    out.flags             = be16(body + 0x00);
    out.valence           = be32(body + 0x02);
    out.folderID          = be32(body + 0x06);
    out.createDate        = be32(body + 0x0A);
    out.contentModDate    = be32(body + 0x0E);
    out.attributeModDate  = be32(body + 0x12);
    out.accessDate        = be32(body + 0x16);
    out.backupDate        = be32(body + 0x1A);
    out.permissions       = parse_bsd_info(body + 0x1E);
    out.userInfo          = parse_finder_info(body + 0x2E);
    out.textEncoding      = be32(body + 0x4E);
    return true;
}

References hfs::CatalogFolder::accessDate, hfs::CatalogFolder::attributeModDate, hfs::CatalogFolder::backupDate, be16(), be32(), hfs::CatalogFolder::contentModDate, hfs::CatalogFolder::createDate, hfs::CatalogFolder::flags, hfs::CatalogFolder::folderID, parse_catalog_folder(), hfs::CatalogFolder::permissions, hfs::CatalogFolder::textEncoding, hfs::CatalogFolder::userInfo, and hfs::CatalogFolder::valence.

Referenced by parse_catalog_folder(), and HfsRecovery::recover().

parse_catalog_key()

bool hfs::parse_catalog_key	(	const unsigned char *	key_buf,
		uint32_t	max_bytes,
		CatalogKey &	out )

Definition at line 111 of file hfs_btree.cpp.

                                         {
    if (key_buf == nullptr || max_bytes < 8) return false;
    out = {};
    const uint16_t keyLength = be16(key_buf + 0);
    // Total key size = 2 (length field) + keyLength bytes of payload.
    // Payload = parentID(4) + nameLength(2) + name[nameLength*2].
    if (keyLength < 6) return false;          // must include parentID + nameLen
    if (2u + keyLength > max_bytes) return false;
    out.total_key_bytes = 2u + keyLength;
    out.parentID   = be32(key_buf + 2);
    out.nameLength = be16(key_buf + 6);
    if (8u + static_cast<uint32_t>(out.nameLength) * 2u > 2u + keyLength) {
        return false;                          // name overflows declared length
    }
    out.name_utf16be = key_buf + 8;
    return true;
}

References be16(), be32(), hfs::CatalogKey::name_utf16be, hfs::CatalogKey::nameLength, hfs::CatalogKey::parentID, parse_catalog_key(), and hfs::CatalogKey::total_key_bytes.

Referenced by parse_catalog_key(), and HfsRecovery::recover().

parse_decmpfs_header()

bool hfs::parse_decmpfs_header	(	const unsigned char *	buf,
		DecmpfsHeader &	out )

Definition at line 81 of file hfs_decmpfs.cpp.

                                                                        {
    if (buf == nullptr) return false;
    out = {};
    out.magic = le32(buf + 0);
    if (out.magic != DECMPFS_MAGIC) return false;
    out.type  = le32(buf + 4);
    // The size field is little-endian 64-bit
    uint64_t size_lo = le32(buf +  8);
    uint64_t size_hi = le32(buf + 12);
    out.size = size_lo | (size_hi << 32);
    return true;
}

References DECMPFS_MAGIC, hfs::DecmpfsHeader::magic, parse_decmpfs_header(), hfs::DecmpfsHeader::size, and hfs::DecmpfsHeader::type.

Referenced by decompress_xattr_zlib(), and parse_decmpfs_header().

parse_fork_data()

bool hfs::parse_fork_data	(	const unsigned char *	buf,
		ForkData &	out )

Definition at line 13 of file hfs_format.cpp.

                                                              {
    if (buf == nullptr) return false;
    out = {};
    out.logical_size = be64(buf + 0x00);
    out.clump_size   = be32(buf + 0x08);
    out.total_blocks = be32(buf + 0x0C);
 
    // 8 extent descriptors, each 8 bytes (start_block + block_count)
    for (size_t i = 0; i < 8; ++i) {
        const unsigned char* p = buf + 0x10 + i * 8;
        out.extents[i].start_block = be32(p + 0);
        out.extents[i].block_count = be32(p + 4);
    }
    return true;
}

References be32(), be64(), hfs::ForkData::clump_size, hfs::ForkData::extents, hfs::ForkData::logical_size, parse_fork_data(), and hfs::ForkData::total_blocks.

Referenced by parse_catalog_file(), parse_fork_data(), and parse_volume_header().

parse_header_rec()

bool hfs::parse_header_rec	(	const unsigned char *	buf,
		HeaderRec &	out )

Definition at line 38 of file hfs_btree.cpp.

                                                                {
    if (buf == nullptr) return false;
    out = {};
    out.treeDepth      = be16(buf + 0x00);
    out.rootNode       = be32(buf + 0x02);
    out.leafRecords    = be32(buf + 0x06);
    out.firstLeafNode  = be32(buf + 0x0A);
    out.lastLeafNode   = be32(buf + 0x0E);
    out.nodeSize       = be16(buf + 0x12);
    out.maxKeyLength   = be16(buf + 0x14);
    out.totalNodes     = be32(buf + 0x16);
    out.freeNodes      = be32(buf + 0x1A);
    // 2 bytes reserved at +0x1E
    out.clumpSize      = be32(buf + 0x20);
    out.btreeType      = buf[0x24];
    out.keyCompareType = buf[0x25];
    out.attributes     = be32(buf + 0x26);
    // 64 bytes of reserved at +0x2A..+0x6A
 
    // Sanity: nodeSize must be a power of 2 in [512, 32768]
    // (uint16_t max is 65535, so the upper bound is implicit; any
    // power-of-two value in our range is necessarily <= 32768)
    if (out.nodeSize < 512 ||
        (out.nodeSize & (out.nodeSize - 1)) != 0) {
        return false;
    }
    // treeDepth must agree with totalNodes (depth==0 means empty tree;
    // depth==1 means a single leaf; depth>16 is implausible).
    if (out.treeDepth > 16) return false;
    return true;
}

References hfs::HeaderRec::attributes, be16(), be32(), hfs::HeaderRec::btreeType, hfs::HeaderRec::clumpSize, hfs::HeaderRec::firstLeafNode, hfs::HeaderRec::freeNodes, hfs::HeaderRec::keyCompareType, hfs::HeaderRec::lastLeafNode, hfs::HeaderRec::leafRecords, hfs::HeaderRec::maxKeyLength, hfs::HeaderRec::nodeSize, parse_header_rec(), hfs::HeaderRec::rootNode, hfs::HeaderRec::totalNodes, and hfs::HeaderRec::treeDepth.

Referenced by find_inline_attribute(), parse_header_rec(), read_fork_full(), and HfsRecovery::recover().

parse_inode_filename()

uint32_t hfs::parse_inode_filename	(	const unsigned char *	utf16be_name,
		uint16_t	name_units )

Definition at line 149 of file hfs_catalog.cpp.

                                                    {
    // "iNode" prefix: 5 ASCII chars + at least 1 digit
    if (name_units < 6) return 0;
    static const char* prefix = "iNode";
    for (int i = 0; i < 5; ++i) {
        const unsigned char hi = utf16be_name[i * 2];
        const unsigned char lo = utf16be_name[i * 2 + 1];
        if (hi != 0) return 0;
        if (lo != static_cast<unsigned char>(prefix[i])) return 0;
    }
    // Decode the trailing digits
    uint32_t num = 0;
    for (uint16_t i = 5; i < name_units; ++i) {
        const unsigned char hi = utf16be_name[i * 2];
        const unsigned char lo = utf16be_name[i * 2 + 1];
        if (hi != 0) return 0;
        if (lo < '0' || lo > '9') return 0;
        const uint32_t prev = num;
        num = num * 10 + (lo - '0');
        if (num < prev) return 0;  // overflow
    }
    return num;
}

References parse_inode_filename().

Referenced by parse_inode_filename(), and HfsRecovery::recover().

parse_node_descriptor()

bool hfs::parse_node_descriptor	(	const unsigned char *	buf,
		NodeDescriptor &	out )

Definition at line 17 of file hfs_btree.cpp.

                                                                          {
    if (buf == nullptr) return false;
    out = {};
    out.fLink      = be32(buf + 0x00);
    out.bLink      = be32(buf + 0x04);
    // kind is a SIGNED 8-bit value (-1 for leaf, 0/1/2 otherwise)
    out.kind       = static_cast<int8_t>(buf[0x08]);
    out.height     = buf[0x09];
    out.numRecords = be16(buf + 0x0A);
    // reserved at +0x0C..+0x0E ignored
 
    // Sanity: kind must be -1, 0, 1, or 2
    if (out.kind != kBTLeafNode &&
        out.kind != kBTIndexNode &&
        out.kind != kBTHeaderNode &&
        out.kind != kBTMapNode) {
        return false;
    }
    return true;
}

References be16(), be32(), hfs::NodeDescriptor::bLink, hfs::NodeDescriptor::fLink, hfs::NodeDescriptor::height, kBTHeaderNode, kBTIndexNode, kBTLeafNode, kBTMapNode, hfs::NodeDescriptor::kind, hfs::NodeDescriptor::numRecords, and parse_node_descriptor().

Referenced by hfs::anonymous_namespace{hfs_btree.cpp}::descend(), find_inline_attribute(), parse_node_descriptor(), read_fork_full(), and HfsRecovery::recover().

parse_volume_header()

bool hfs::parse_volume_header	(	const unsigned char *	buf,
		VolumeHeader &	out )

Definition at line 29 of file hfs_format.cpp.

                                                                      {
    if (buf == nullptr) return false;
 
    out = {};
    out.signature = be16(buf + 0x00);
    if (out.signature != HFSPLUS_SIGNATURE && out.signature != HFSX_SIGNATURE) {
        return false;
    }
    out.version = be16(buf + 0x02);
    // For HFS+ classic the version must be 4; for HFSX it must be 5.
    if (out.is_hfsplus() && out.version != HFSPLUS_VERSION) return false;
    if (out.is_hfsx()    && out.version != HFSX_VERSION)    return false;
 
    out.attributes           = be32(buf + 0x04);
    out.last_mounted_version = be32(buf + 0x08);
    out.journal_info_block   = be32(buf + 0x0C);
    out.create_date          = be32(buf + 0x10);
    out.modify_date          = be32(buf + 0x14);
    out.backup_date          = be32(buf + 0x18);
    out.checked_date         = be32(buf + 0x1C);
    out.file_count           = be32(buf + 0x20);
    out.folder_count         = be32(buf + 0x24);
    out.block_size           = be32(buf + 0x28);
    out.total_blocks         = be32(buf + 0x2C);
    out.free_blocks          = be32(buf + 0x30);
    out.next_allocation      = be32(buf + 0x34);
    out.rsrc_clump_size      = be32(buf + 0x38);
    out.data_clump_size      = be32(buf + 0x3C);
    out.next_catalog_id      = be32(buf + 0x40);
    out.write_count          = be32(buf + 0x44);
    out.encodings_bitmap     = be64(buf + 0x48);
 
    // finderInfo is 32 bytes at offset 0x50 (8 * uint32 in raw form, but
    // we treat it opaquely)
    std::copy(buf + 0x50, buf + 0x70, out.finder_info.begin());
 
    // Five fork-data structs, each 80 bytes, starting at offset 0x70:
    //   allocationFile  @ 0x070
    //   extentsFile     @ 0x0C0
    //   catalogFile     @ 0x110
    //   attributesFile  @ 0x160
    //   startupFile     @ 0x1B0
    // End: 0x1B0 + 0x50 = 0x200 (= 512 bytes total).
    if (!parse_fork_data(buf + 0x070, out.allocation_file)) return false;
    if (!parse_fork_data(buf + 0x0C0, out.extents_file))    return false;
    if (!parse_fork_data(buf + 0x110, out.catalog_file))    return false;
    if (!parse_fork_data(buf + 0x160, out.attributes_file)) return false;
    if (!parse_fork_data(buf + 0x1B0, out.startup_file))    return false;
 
    // Sanity checks
    // block_size must be a power of 2 in [512, 65536]
    if (out.block_size < 512 || out.block_size > 65536 ||
        (out.block_size & (out.block_size - 1)) != 0) {
        return false;
    }
    // total_blocks must be plausible: at least the volume header occupies
    // some blocks; reject zero. Also reject absurdly large values.
    if (out.total_blocks == 0) return false;
 
    // The catalog file must have a non-zero size (every HFS+ volume has
    // at least the root folder and root thread record).
    if (out.catalog_file.logical_size == 0) return false;
    if (out.catalog_file.total_blocks == 0) return false;
 
    // Sanity: the first extent of each special file must point INTO the
    // volume range. Extent start_block + block_count <= total_blocks.
    auto fork_in_range = [&](const ForkData& f) -> bool {
        for (const auto& e : f.extents) {
            if (e.block_count == 0) continue;
            // Defensive: prevent overflow
            if (e.start_block > out.total_blocks) return false;
            const uint64_t end = static_cast<uint64_t>(e.start_block)
                                + e.block_count;
            if (end > out.total_blocks) return false;
        }
        return true;
    };
    if (!fork_in_range(out.allocation_file)) return false;
    if (!fork_in_range(out.extents_file))    return false;
    if (!fork_in_range(out.catalog_file))    return false;
    if (!fork_in_range(out.attributes_file)) return false;
    if (!fork_in_range(out.startup_file))    return false;
 
    return true;
}

References hfs::VolumeHeader::allocation_file, hfs::VolumeHeader::attributes, hfs::VolumeHeader::attributes_file, hfs::VolumeHeader::backup_date, be16(), be32(), be64(), hfs::VolumeHeader::block_size, hfs::VolumeHeader::catalog_file, hfs::VolumeHeader::checked_date, hfs::VolumeHeader::create_date, hfs::VolumeHeader::data_clump_size, hfs::VolumeHeader::encodings_bitmap, hfs::VolumeHeader::extents_file, hfs::VolumeHeader::file_count, hfs::VolumeHeader::finder_info, hfs::VolumeHeader::folder_count, hfs::VolumeHeader::free_blocks, HFSPLUS_SIGNATURE, HFSPLUS_VERSION, HFSX_SIGNATURE, HFSX_VERSION, hfs::VolumeHeader::is_hfsplus(), hfs::VolumeHeader::is_hfsx(), hfs::VolumeHeader::journal_info_block, hfs::VolumeHeader::last_mounted_version, hfs::ForkData::logical_size, hfs::VolumeHeader::modify_date, hfs::VolumeHeader::next_allocation, hfs::VolumeHeader::next_catalog_id, parse_fork_data(), parse_volume_header(), hfs::VolumeHeader::rsrc_clump_size, hfs::VolumeHeader::signature, hfs::VolumeHeader::startup_file, hfs::ForkData::total_blocks, hfs::VolumeHeader::total_blocks, hfs::VolumeHeader::version, and hfs::VolumeHeader::write_count.

Referenced by anonymous_namespace{filesystem_probes.cpp}::hfs_probe(), anonymous_namespace{lost_partition_finder.cpp}::hfs_size_bytes(), parse_volume_header(), and HfsRecovery::recover().

read_fork_block_inline()

bool hfs::read_fork_block_inline	(	DiskReader &	reader,
		uint64_t	volume_offset,
		uint32_t	block_size,
		const ForkData &	fork,
		uint64_t	fork_logical_offset,
		unsigned char *	block_buf )

Definition at line 69 of file hfs_fork_io.cpp.

                                                       {
    if (block_size == 0 || block_buf == nullptr) return false;
 
    // The fork is a concatenation of its extents. We walk extents
    // accumulating their byte coverage; when we reach the extent that
    // contains fork_logical_offset, we compute the absolute disk offset
    // and issue a single read.
    uint64_t covered = 0;
    for (const auto& e : fork.extents) {
        if (e.block_count == 0) continue;
        const uint64_t ext_bytes =
            static_cast<uint64_t>(e.block_count) * block_size;
        if (fork_logical_offset < covered + ext_bytes) {
            // Hit. The byte we want is at:
            const uint64_t byte_within_ext = fork_logical_offset - covered;
            // Round to a block boundary (fork_logical_offset should be
            // block-aligned, but be defensive).
            const uint64_t blk_within_ext = byte_within_ext / block_size;
            const uint64_t disk_off =
                volume_offset
              + (static_cast<uint64_t>(e.start_block) + blk_within_ext)
                * block_size;
            return reader.read_at(disk_off, block_buf, block_size);
        }
        covered += ext_bytes;
    }
    // Offset beyond inline coverage -- needs Extents Overflow file.
    return false;
}

References hfs::ForkData::extents, DiskReader::read_at(), and read_fork_block_inline().

Referenced by read_fork_block_inline().

read_fork_full()

bool hfs::read_fork_full	(	DiskReader &	reader,
		uint64_t	volume_offset,
		uint32_t	block_size,
		const ForkData &	fork,
		const ForkData &	extents_file,
		uint8_t	forkType,
		uint32_t	fileID,
		uint64_t	max_bytes,
		std::vector< unsigned char > &	extents_btree_buffer,
		std::vector< unsigned char > &	out,
		std::vector< std::string > &	logs )

Definition at line 200 of file hfs_fork_io.cpp.

                                                {
    if (block_size == 0) return false;
 
    // Compute inline coverage.
    uint64_t inline_blocks = 0;
    int inline_extent_count = 0;
    for (const auto& e : fork.extents) {
        if (e.block_count == 0) break;  // run terminator
        inline_blocks += e.block_count;
        ++inline_extent_count;
    }
    const uint64_t inline_bytes = inline_blocks * block_size;
 
    const uint64_t want = std::min<uint64_t>(fork.logical_size, max_bytes);
 
    // Fast path: fork fits in inline extents.
    if (fork.total_blocks <= inline_blocks || inline_extent_count < 8) {
        return read_fork_inline(reader, volume_offset, block_size,
                                 fork, want, out, logs);
    }
 
    // Slow path: file has > 8 extents (overflow needed).
    // Step 1: load the Extents Overflow B-tree if not already cached.
    if (extents_btree_buffer.empty()) {
        std::vector<std::string> ld_logs;
        if (!read_fork_inline(reader, volume_offset, block_size,
                               extents_file, extents_file.logical_size,
                               extents_btree_buffer, ld_logs)) {
            logs.push_back("HFS+: cannot load Extents Overflow file content "
                            "(file with >8 extents will be soft-truncated)");
            for (auto& l : ld_logs) logs.push_back(std::move(l));
            extents_btree_buffer.clear();  // mark as "tried but failed"
            return read_fork_inline(reader, volume_offset, block_size,
                                     fork, want, out, logs);
        }
    }
    if (extents_btree_buffer.size() < 14) {
        logs.push_back("HFS+: Extents Overflow file too small for B-tree");
        return read_fork_inline(reader, volume_offset, block_size,
                                 fork, want, out, logs);
    }
 
    // Step 2: parse overflow B-tree header (node 0).
    NodeDescriptor n0;
    if (!parse_node_descriptor(extents_btree_buffer.data(), n0) ||
        n0.kind != kBTHeaderNode) {
        logs.push_back("HFS+: Extents Overflow node 0 not a header node");
        return read_fork_inline(reader, volume_offset, block_size,
                                 fork, want, out, logs);
    }
    HeaderRec ohdr;
    if (!parse_header_rec(extents_btree_buffer.data() + 14, ohdr)) {
        logs.push_back("HFS+: Extents Overflow B-tree header parse failed");
        return read_fork_inline(reader, volume_offset, block_size,
                                 fork, want, out, logs);
    }
 
    // Step 3: collect extra extents from overflow B-tree.
    std::vector<ForkExtent> overflow_extents;
    collect_overflow_extents(extents_btree_buffer, ohdr,
                              forkType, fileID, overflow_extents, logs);
 
    // Step 4: build a unified extent list (8 inline followed by overflow).
    std::vector<ForkExtent> all_extents;
    all_extents.reserve(8 + overflow_extents.size());
    for (const auto& e : fork.extents) {
        if (e.block_count == 0) break;
        all_extents.push_back(e);
    }
    for (const auto& e : overflow_extents) all_extents.push_back(e);
 
    // Step 5: read all blocks in order.
    out.clear();
    out.reserve(static_cast<size_t>(want));
    uint64_t produced = 0;
    for (const auto& e : all_extents) {
        if (produced >= want) break;
        const uint64_t ext_bytes =
            static_cast<uint64_t>(e.block_count) * block_size;
        const uint64_t copy = std::min<uint64_t>(ext_bytes, want - produced);
        if (!read_one_extent(reader, volume_offset, block_size, e, copy, out)) {
            std::ostringstream m;
            m << "HFS+: read failure on overflow extent (start_block="
              << e.start_block << ", count=" << e.block_count << ")";
            logs.push_back(m.str());
            return false;
        }
        produced += copy;
    }
 
    // If we have less than `want`, log it but don't fail (best-effort).
    if (produced < want) {
        std::ostringstream m;
        m << "HFS+: requested " << want << " bytes from fork (fileID="
          << fileID << "), got " << produced
          << " (file may be truncated or overflow records missing)";
        logs.push_back(m.str());
    }
 
    (void)inline_bytes;
    return true;
}

References hfs::ForkData::extents, kBTHeaderNode, hfs::NodeDescriptor::kind, hfs::ForkData::logical_size, parse_header_rec(), parse_node_descriptor(), read_fork_full(), read_fork_inline(), and hfs::ForkData::total_blocks.

Referenced by read_fork_full(), and HfsRecovery::recover().

read_fork_inline()

bool hfs::read_fork_inline	(	DiskReader &	reader,
		uint64_t	volume_offset,
		uint32_t	block_size,
		const ForkData &	fork,
		uint64_t	max_bytes,
		std::vector< unsigned char > &	out,
		std::vector< std::string > &	logs )

Definition at line 12 of file hfs_fork_io.cpp.

                                                  {
    if (block_size == 0) return false;
 
    // Total bytes we want to read: min of fork.logical_size, max_bytes,
    // and inline-coverage (sum of all extent lengths in bytes).
    uint64_t inline_bytes = 0;
    for (const auto& e : fork.extents) {
        inline_bytes += static_cast<uint64_t>(e.block_count) * block_size;
    }
 
    uint64_t want = std::min<uint64_t>(fork.logical_size, max_bytes);
    if (want > inline_bytes) {
        std::ostringstream m;
        m << "HFS+ fork: requested " << want
          << " bytes but only " << inline_bytes
          << " bytes covered by inline extents (file > 8 extents would "
             "need Extents Overflow file -- session 4)";
        logs.push_back(m.str());
        want = inline_bytes;  // soft truncate
    }
 
    out.clear();
    out.reserve(static_cast<size_t>(want));
 
    uint64_t produced = 0;
    for (const auto& e : fork.extents) {
        if (produced >= want) break;
        if (e.block_count == 0) continue;
 
        const uint64_t ext_disk_off =
            volume_offset
          + static_cast<uint64_t>(e.start_block) * block_size;
        const uint64_t ext_bytes =
            static_cast<uint64_t>(e.block_count) * block_size;
        const uint64_t copy = std::min<uint64_t>(ext_bytes, want - produced);
 
        const size_t before = out.size();
        out.resize(before + static_cast<size_t>(copy));
        if (!reader.read_at(ext_disk_off, out.data() + before, copy)) {
            std::ostringstream m;
            m << "HFS+ fork: read failed at disk offset " << ext_disk_off
              << " for " << copy << " bytes";
            logs.push_back(m.str());
            out.resize(before);
            return false;
        }
        produced += copy;
    }
    return true;
}

References hfs::ForkData::extents, hfs::ForkData::logical_size, DiskReader::read_at(), and read_fork_inline().

Referenced by read_fork_full(), read_fork_inline(), and HfsRecovery::recover().

utf16be_to_utf8()

std::string hfs::utf16be_to_utf8	(	const unsigned char *	src,
		size_t	code_units )

Definition at line 254 of file hfs_unicode.cpp.

                                                                       {
    if (src == nullptr || code_units == 0) return {};
    auto cps = utf16be_to_codepoints(src, code_units);
    return codepoints_to_utf8(cps);
}

References utf16be_to_utf8().

Referenced by utf16be_to_utf8().

walk_btree()

bool hfs::walk_btree	(	const HeaderRec &	header,
		const NodeReader &	read_node,
		const LeafRecordCallback &	on_leaf,
		std::vector< std::string > &	logs,
		std::string &	error )

Definition at line 269 of file hfs_btree.cpp.

                                  {
    if (header.rootNode == 0 || header.nodeSize == 0) {
        error = "HFS+ B-tree: empty/zero rootNode";
        return false;
    }
    if (header.treeDepth > 16) {
        error = "HFS+ B-tree: implausible tree depth";
        return false;
    }
    std::set<uint32_t> visited;
    size_t nodes_visited = 0;
    bool callback_stopped = false;
    return descend(header.rootNode, header.treeDepth, header, read_node,
                   on_leaf, visited, nodes_visited, logs, error,
                   callback_stopped);
}

References hfs::HeaderRec::nodeSize, hfs::HeaderRec::rootNode, hfs::HeaderRec::treeDepth, and walk_btree().

Referenced by hfs::anonymous_namespace{hfs_fork_io.cpp}::collect_overflow_extents(), find_inline_attribute(), HfsRecovery::recover(), and walk_btree().

Variable Documentation

DECMPFS_HEADER_SIZE

size_t hfs::DECMPFS_HEADER_SIZE = 16

constexpr

Definition at line 66 of file hfs_decmpfs.hpp.

Referenced by decompress_xattr_zlib().

DECMPFS_MAGIC

uint32_t hfs::DECMPFS_MAGIC = 0x66706D63

constexpr

Definition at line 64 of file hfs_decmpfs.hpp.

Referenced by parse_decmpfs_header().

HFSPLUS_SIGNATURE

uint16_t hfs::HFSPLUS_SIGNATURE = 0x482B

constexpr

Definition at line 73 of file hfs_format.hpp.

Referenced by hfs::VolumeHeader::is_hfsplus(), anonymous_namespace{lost_partition_finder.cpp}::looks_hfs(), and parse_volume_header().

HFSPLUS_VERSION

uint16_t hfs::HFSPLUS_VERSION = 4

constexpr

Definition at line 75 of file hfs_format.hpp.

Referenced by parse_volume_header().

HFSPLUS_VOLUME_HEADER_OFFSET

uint32_t hfs::HFSPLUS_VOLUME_HEADER_OFFSET = 1024

constexpr

Definition at line 79 of file hfs_format.hpp.

Referenced by anonymous_namespace{filesystem_probes.cpp}::hfs_probe(), anonymous_namespace{lost_partition_finder.cpp}::hfs_size_bytes(), anonymous_namespace{lost_partition_finder.cpp}::looks_hfs(), and HfsRecovery::recover().

HFSX_SIGNATURE

uint16_t hfs::HFSX_SIGNATURE = 0x4858

constexpr

Definition at line 74 of file hfs_format.hpp.

Referenced by hfs::VolumeHeader::is_hfsx(), anonymous_namespace{lost_partition_finder.cpp}::looks_hfs(), and parse_volume_header().

HFSX_VERSION

uint16_t hfs::HFSX_VERSION = 5

constexpr

Definition at line 76 of file hfs_format.hpp.

Referenced by parse_volume_header().

kBTHeaderNode

int8_t hfs::kBTHeaderNode = 1

constexpr

Definition at line 34 of file hfs_btree.hpp.

Referenced by find_inline_attribute(), parse_node_descriptor(), read_fork_full(), and HfsRecovery::recover().

kBTIndexNode

int8_t hfs::kBTIndexNode = 0

constexpr

Definition at line 33 of file hfs_btree.hpp.

Referenced by hfs::anonymous_namespace{hfs_btree.cpp}::descend(), and parse_node_descriptor().

kBTLeafNode

int8_t hfs::kBTLeafNode = -1

constexpr

Definition at line 32 of file hfs_btree.hpp.

Referenced by hfs::anonymous_namespace{hfs_btree.cpp}::descend(), and parse_node_descriptor().

kBTMapNode

int8_t hfs::kBTMapNode = 2

constexpr

Definition at line 35 of file hfs_btree.hpp.

Referenced by parse_node_descriptor().

kCompressionType_LzfseInRsrc

uint32_t hfs::kCompressionType_LzfseInRsrc = 12

constexpr

Definition at line 76 of file hfs_decmpfs.hpp.

Referenced by decmpfs_type_name().

kCompressionType_LzfseInXattr

uint32_t hfs::kCompressionType_LzfseInXattr = 11

constexpr

Definition at line 75 of file hfs_decmpfs.hpp.

Referenced by decmpfs_type_name().

kCompressionType_LzvnInRsrc

uint32_t hfs::kCompressionType_LzvnInRsrc = 8

constexpr

Definition at line 74 of file hfs_decmpfs.hpp.

Referenced by decmpfs_type_name().

kCompressionType_LzvnInXattr

uint32_t hfs::kCompressionType_LzvnInXattr = 7

constexpr

Definition at line 73 of file hfs_decmpfs.hpp.

Referenced by decmpfs_type_name().

kCompressionType_None

uint32_t hfs::kCompressionType_None = 1

constexpr

Definition at line 70 of file hfs_decmpfs.hpp.

Referenced by decmpfs_type_name().

kCompressionType_ZlibInRsrc

uint32_t hfs::kCompressionType_ZlibInRsrc = 4

constexpr

Definition at line 72 of file hfs_decmpfs.hpp.

Referenced by decmpfs_supported(), and decmpfs_type_name().

kCompressionType_ZlibInXattr

uint32_t hfs::kCompressionType_ZlibInXattr = 3

constexpr

Definition at line 71 of file hfs_decmpfs.hpp.

Referenced by decmpfs_supported(), decmpfs_type_name(), and decompress_xattr_zlib().

kDecmpfsBlockSize

size_t hfs::kDecmpfsBlockSize = 64 * 1024

constexpr

Definition at line 67 of file hfs_decmpfs.hpp.

Referenced by decompress_resource_fork_zlib().

kForkTypeData

uint8_t hfs::kForkTypeData = 0x00

constexpr

Definition at line 86 of file hfs_fork_io.hpp.

Referenced by HfsRecovery::recover().

kForkTypeResource

uint8_t hfs::kForkTypeResource = 0xFF

constexpr

Definition at line 87 of file hfs_fork_io.hpp.

Referenced by HfsRecovery::recover().

kHardLinkFileType

uint32_t hfs::kHardLinkFileType = 0x686C6E6B

constexpr

Definition at line 56 of file hfs_catalog.hpp.

Referenced by hfs::CatalogFile::is_hardlink(), and HfsRecovery::recover().

kHFSAllocationFileID

uint32_t hfs::kHFSAllocationFileID = 6

constexpr

Definition at line 92 of file hfs_format.hpp.

kHFSAttributesFileID

uint32_t hfs::kHFSAttributesFileID = 8

constexpr

Definition at line 94 of file hfs_format.hpp.

kHFSBadBlockFileID

uint32_t hfs::kHFSBadBlockFileID = 5

constexpr

Definition at line 91 of file hfs_format.hpp.

kHFSBinaryCompare

uint8_t hfs::kHFSBinaryCompare = 0xBC

constexpr

Definition at line 39 of file hfs_btree.hpp.

kHFSBogusExtentFileID

uint32_t hfs::kHFSBogusExtentFileID = 15

constexpr

Definition at line 96 of file hfs_format.hpp.

kHFSBTreeType

uint8_t hfs::kHFSBTreeType = 0xFF

constexpr

Definition at line 42 of file hfs_btree.hpp.

kHFSCaseFolding

uint8_t hfs::kHFSCaseFolding = 0xCF

constexpr

Definition at line 38 of file hfs_btree.hpp.

kHFSCatalogFileID

uint32_t hfs::kHFSCatalogFileID = 4

constexpr

Definition at line 90 of file hfs_format.hpp.

kHFSExtentsFileID

uint32_t hfs::kHFSExtentsFileID = 3

constexpr

Definition at line 89 of file hfs_format.hpp.

kHFSFileLockedBit

uint16_t hfs::kHFSFileLockedBit = 0x0001

constexpr

Definition at line 101 of file hfs_catalog.hpp.

kHFSFirstUserCatalogNodeID

uint32_t hfs::kHFSFirstUserCatalogNodeID = 16

constexpr

Definition at line 97 of file hfs_format.hpp.

kHFSHasAttributesBit

uint16_t hfs::kHFSHasAttributesBit = 0x0004

constexpr

Definition at line 103 of file hfs_catalog.hpp.

Referenced by HfsRecovery::recover().

kHFSHasChildLinkBit

uint16_t hfs::kHFSHasChildLinkBit = 0x0040

constexpr

Definition at line 107 of file hfs_catalog.hpp.

kHFSHasDateAddedBit

uint16_t hfs::kHFSHasDateAddedBit = 0x0080

constexpr

Definition at line 108 of file hfs_catalog.hpp.

kHFSHasFolderCountBit

uint16_t hfs::kHFSHasFolderCountBit = 0x0010

constexpr

Definition at line 105 of file hfs_catalog.hpp.

kHFSHasLinkChainBit

uint16_t hfs::kHFSHasLinkChainBit = 0x0020

constexpr

Definition at line 106 of file hfs_catalog.hpp.

kHFSHasSecurityBit

uint16_t hfs::kHFSHasSecurityBit = 0x0008

constexpr

Definition at line 104 of file hfs_catalog.hpp.

kHFSPlusAttrExtents

uint32_t hfs::kHFSPlusAttrExtents = 0x30

constexpr

Definition at line 51 of file hfs_attributes.hpp.

kHFSPlusAttrForkData

uint32_t hfs::kHFSPlusAttrForkData = 0x20

constexpr

Definition at line 50 of file hfs_attributes.hpp.

kHFSPlusAttrInlineData

uint32_t hfs::kHFSPlusAttrInlineData = 0x10

constexpr

Definition at line 49 of file hfs_attributes.hpp.

Referenced by find_inline_attribute().

kHFSPlusCreator

uint32_t hfs::kHFSPlusCreator = 0x6866732B

constexpr

Definition at line 57 of file hfs_catalog.hpp.

Referenced by hfs::CatalogFile::is_hardlink(), and HfsRecovery::recover().

kHFSPlusFileRecord

int16_t hfs::kHFSPlusFileRecord = 0x0002

constexpr

Definition at line 115 of file hfs_btree.hpp.

Referenced by HfsRecovery::recover().

kHFSPlusFileThreadRecord

int16_t hfs::kHFSPlusFileThreadRecord = 0x0004

constexpr

Definition at line 117 of file hfs_btree.hpp.

Referenced by HfsRecovery::recover().

kHFSPlusFolderRecord

int16_t hfs::kHFSPlusFolderRecord = 0x0001

constexpr

Definition at line 114 of file hfs_btree.hpp.

Referenced by HfsRecovery::recover().

kHFSPlusFolderThreadRecord

int16_t hfs::kHFSPlusFolderThreadRecord = 0x0003

constexpr

Definition at line 116 of file hfs_btree.hpp.

Referenced by HfsRecovery::recover().

kHFSPrivateDataNameLength

int hfs::kHFSPrivateDataNameLength = 21

constexpr

Definition at line 135 of file hfs_catalog.hpp.

Referenced by is_private_data_folder_name().

kHFSRepairCatalogFileID

uint32_t hfs::kHFSRepairCatalogFileID = 14

constexpr

Definition at line 95 of file hfs_format.hpp.

kHFSRootFolderID

uint32_t hfs::kHFSRootFolderID = 2

constexpr

Definition at line 88 of file hfs_format.hpp.

Referenced by HfsRecovery::recover().

kHFSRootParentID

uint32_t hfs::kHFSRootParentID = 1

constexpr

Definition at line 87 of file hfs_format.hpp.

kHFSStartupFileID

uint32_t hfs::kHFSStartupFileID = 7

constexpr

Definition at line 93 of file hfs_format.hpp.

kHFSThreadExistsBit

uint16_t hfs::kHFSThreadExistsBit = 0x0002

constexpr

Definition at line 102 of file hfs_catalog.hpp.

kHFSVolumeJournaledBit

uint32_t hfs::kHFSVolumeJournaledBit = (1u << 13)

constexpr

Definition at line 83 of file hfs_format.hpp.

Referenced by hfs::VolumeHeader::is_journaled().

kHFSVolumeSoftwareLockBit

uint32_t hfs::kHFSVolumeSoftwareLockBit = (1u << 15)

constexpr

Definition at line 84 of file hfs_format.hpp.

kHFSVolumeUnmountedBit

uint32_t hfs::kHFSVolumeUnmountedBit = (1u << 8)

constexpr

Definition at line 82 of file hfs_format.hpp.

kReservedBTreeType

uint8_t hfs::kReservedBTreeType = 0x00

constexpr

Definition at line 44 of file hfs_btree.hpp.

kSymLinkCreator

uint32_t hfs::kSymLinkCreator = 0x72686170

constexpr

Definition at line 53 of file hfs_catalog.hpp.

Referenced by hfs::CatalogFile::is_symlink(), and HfsRecovery::recover().

kSymLinkFileType

uint32_t hfs::kSymLinkFileType = 0x736C6E6B

constexpr

Definition at line 52 of file hfs_catalog.hpp.

Referenced by hfs::CatalogFile::is_symlink(), and HfsRecovery::recover().

kUserBTreeType

uint8_t hfs::kUserBTreeType = 0x80

constexpr

Definition at line 43 of file hfs_btree.hpp.

UF_COMPRESSED

uint8_t hfs::UF_COMPRESSED = 0x20

constexpr

Definition at line 112 of file hfs_catalog.hpp.

Referenced by HfsRecovery::recover().