hfs_format.hpp

1. Overview

The hfs_format.hpp file defines constants, endian helpers and packed structures for HFS/HFS+ metadata.

This is an interface and data-contract file. It declares the public and internal types used by this subsystem, allowing implementation files and callers to share a stable compile-time contract.

Its paired source or interface file is hfs_format.cpp.

Primary responsibilities:

  • Describe volume, catalog, extent and attribute records
  • Centralize magic values and flags
  • Provide endian-safe decoding helpers

2. File Identity and Scope

  • Source path: src/hfs_format.hpp
  • Language: C++
  • File role: interface and data-contract file
  • Physical lines: 201
  • Non-empty lines: 178
  • SHA-256: f065d1af851351fb9ae589086fb7862f12ae90bd0edfa96f372393afbc7662c9

Declared namespaces:

  • hfs

3. Dependencies

3.2 Standard and External Headers

  • array
  • cstdint
  • cstddef
  • string
  • vector

These dependencies define the file’s compile-time integration with the recovery engine, GTK interface, on-disk format decoders, operating-system services, or C++ standard library.

4. Declared Types

  • struct ForkExtent.
  • struct ForkData.
  • struct VolumeHeader.
  • struct VolumeContext.

5. Constants and Configuration Values

  • constexpr uint16_t HFSPLUS_SIGNATURE=0x482B
  • constexpr uint16_t HFSX_SIGNATURE=0x4858
  • constexpr uint16_t HFSPLUS_VERSION=4
  • constexpr uint16_t HFSX_VERSION=5
  • constexpr uint32_t HFSPLUS_VOLUME_HEADER_OFFSET=1024
  • constexpr uint32_t kHFSVolumeUnmountedBit=(1u << 8)
  • constexpr uint32_t kHFSVolumeJournaledBit=(1u << 13)
  • constexpr uint32_t kHFSVolumeSoftwareLockBit=(1u << 15)
  • constexpr uint32_t kHFSRootParentID=1
  • constexpr uint32_t kHFSRootFolderID=2
  • constexpr uint32_t kHFSExtentsFileID=3
  • constexpr uint32_t kHFSCatalogFileID=4
  • constexpr uint32_t kHFSBadBlockFileID=5
  • constexpr uint32_t kHFSAllocationFileID=6
  • constexpr uint32_t kHFSStartupFileID=7
  • constexpr uint32_t kHFSAttributesFileID=8
  • constexpr uint32_t kHFSRepairCatalogFileID=14
  • constexpr uint32_t kHFSBogusExtentFileID=15
  • constexpr uint32_t kHFSFirstUserCatalogNodeID=16

5.1 Operational Strings, Paths, Formats, or Commands

The following code literals are operationally relevant and may identify filesystem paths, helper commands, formats, signatures, or subsystem labels:

  • HFS Plus Volume Format
  • HFSX
  • HFS+

6. Data Members and Persistent State

The interface declares the following state-bearing members:

  • constexpr uint16_t HFSPLUS_SIGNATURE=0x482B
  • constexpr uint16_t HFSX_SIGNATURE=0x4858
  • constexpr uint16_t HFSPLUS_VERSION=4
  • constexpr uint16_t HFSX_VERSION=5
  • constexpr uint32_t HFSPLUS_VOLUME_HEADER_OFFSET=1024
  • constexpr uint32_t kHFSRootParentID=1
  • constexpr uint32_t kHFSRootFolderID=2
  • constexpr uint32_t kHFSExtentsFileID=3
  • constexpr uint32_t kHFSCatalogFileID=4
  • constexpr uint32_t kHFSBadBlockFileID=5
  • constexpr uint32_t kHFSAllocationFileID=6
  • constexpr uint32_t kHFSStartupFileID=7
  • constexpr uint32_t kHFSAttributesFileID=8
  • constexpr uint32_t kHFSRepairCatalogFileID=14
  • constexpr uint32_t kHFSBogusExtentFileID=15
  • constexpr uint32_t kHFSFirstUserCatalogNodeID=16
  • uint32_t start_block {0}
  • uint32_t block_count {0}
  • uint64_t logical_size {0}
  • uint32_t clump_size {0}
  • uint32_t total_blocks {0}
  • std::array<ForkExtent,8> extents {}
  • uint16_t signature {0}
  • uint16_t version {0}
  • uint32_t attributes {0}
  • uint32_t last_mounted_version {0}
  • uint32_t journal_info_block {0}
  • uint32_t create_date {0}
  • uint32_t modify_date {0}
  • uint32_t backup_date {0}
  • uint32_t checked_date {0}
  • uint32_t file_count {0}
  • uint32_t folder_count {0}
  • uint32_t block_size {0}
  • uint32_t free_blocks {0}
  • uint32_t next_allocation {0}
  • uint32_t rsrc_clump_size {0}
  • uint32_t data_clump_size {0}
  • uint32_t next_catalog_id {0}
  • uint32_t write_count {0}
  • uint64_t encodings_bitmap{0}
  • std::array<uint8_t,32> finder_info {}
  • ForkData allocation_file {}
  • ForkData extents_file {}
  • ForkData catalog_file {}
  • ForkData attributes_file {}
  • ForkData startup_file {}
  • VolumeHeader header {}
  • uint64_t volume_offset {0}
  • bool is_v5_hfsx {false}

These members hold configuration, parser context, UI widgets, source references, progress state, recovered metadata, or temporary resources according to the owning type.

7. API and Function Inventory

The following callable interfaces or definitions were detected:

  • inline uint16_t be16(const unsigned char*p) – Implements the operation identified by this API and updates or returns the associated state.
  • inline uint32_t be32(const unsigned char*p) – Implements the operation identified by this API and updates or returns the associated state.
  • inline uint64_t be64(const unsigned char*p) – Implements the operation identified by this API and updates or returns the associated state.
  • bool parse_fork_data(const unsigned char*buf,ForkData&out) – Reads or derives the requested information and returns or stores the decoded result.
  • bool is_hfsplus()const – Evaluates the stated condition and returns the corresponding Boolean result.
  • bool is_hfsx()const – Evaluates the stated condition and returns the corresponding Boolean result.
  • bool is_journaled()const – Evaluates the stated condition and returns the corresponding Boolean result.
  • uint64_t volume_size_bytes()const – Implements the operation identified by this API and updates or returns the associated state.
  • bool parse_volume_header(const unsigned char*buf,VolumeHeader&out) – Reads or derives the requested information and returns or stores the decoded result.
  • inline uint64_t alloc_block_to_disk_offset(uint64_t volume_offset,uint32_t alloc_block,uint32_t block_size) – Implements the operation identified by this API and updates or returns the associated state.

8. Operational Flow

The subsystem represented by this file normally participates in the following flow:

  1. Describe volume, catalog, extent and attribute records.
  2. Centralize magic values and flags.
  3. Provide endian-safe decoding helpers.
  4. Expose or execute the detected APIs: be16, be32, be64, parse_fork_data, is_hfsplus, is_hfsx, is_journaled, volume_size_bytes, parse_volume_header, alloc_block_to_disk_offset.
  5. Return explicit results, progress data, recovered records, or diagnostics to the calling layer.

9. Validation and Error Handling

  • Byte offsets, sizes and lengths must be validated before arithmetic and before every read to avoid overflow and out-of-bounds access.
  • On-disk structures are accepted only after validating signatures, magic values and structural constraints.
  • Input and output paths require existence checks, permission handling and safe destination construction.

10. Runtime, Concurrency, and Resource Management

  • Deterministic behavior: callers depend on explicit return values and stable data structures to distinguish successful recovery from partial or invalid results.
  • Temporary loop devices, mappings and mounts require deterministic reverse-order cleanup.

11. Security and Data-Recovery Considerations

  • Recovery code should prefer read-only source access and avoid writing to the original damaged medium.
  • Raw devices and image files are treated as untrusted binary input; every offset and length must remain bounded by the source size.
  • Operations that open block devices, create mappings or mount filesystems require elevated privileges and should expose the smallest possible privileged surface.

12. Implementation Considerations

  • Changes to public declarations can affect every translation unit that includes this header and should preserve binary and source compatibility where required.
  • State-bearing members should have explicit ownership and initialization semantics, especially for references, pointers, file descriptors and GTK widgets.
  • Large-device arithmetic uses 64-bit values; additions and multiplications should be checked before use as offsets or allocation sizes.

13. Integration with the Recovery Pipeline

  • The file belongs to the source-discovery, parsing or support layer.
  • Its results feed scanner, recovery or reporting modules through shared models.
  • The API should remain deterministic so higher layers can combine results safely.

14. Licensing and Provenance

No explicit copyright or software-license statement was detected in the opening section of this individual file. Distribution terms should therefore be verified against the project-level license and repository metadata.

The SHA-256 value in this document can be used to associate the generated documentation with the exact source version analyzed.

Published on:
Last updated on: