HFS Plus / HFSX
| Format | HFS Plus / HFSX |
|---|---|
| Short name | HFS+ |
| Category | filesystem |
| Platforms | macOS, iOS |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Apple's filesystem before APFS (Mac OS 8.1 to macOS 10.12, on hard disks and Fusion Drives to 10.13, still on many external drives and older Time Machine disks). Files and folders are records in a catalog B-tree, with an extents overflow file and an attributes file for extended attributes and compressed (decmpfs) data. HFSX is the case-sensitive variant, also used by iOS before 10.3. An optional journal records metadata changes. Timestamps are seconds since 1904, local time on the volume header's creation date and UTC elsewhere.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 1024 (0x400) | 48 2B 00 04 | H+.. | HFS Plus volume header ('H+', version 4) |
| offset 1024 (0x400) | 48 58 00 05 | HX.. | HFSX volume header ('HX', version 5) |
Known extensions
None recorded
References
- Technical Note TN1150: HFS Plus Volume Format (Apple) https://developer.apple.com/library/archive/technotes/tn/tn1150.html
- Hierarchical File System (HFS) — format documentation (libyal/libfshfs) https://github.com/libyal/libfshfs/blob/main/documentation/Hierarchical%20File%20System%20(HFS).asciidoc
- ForensicsWiki — HFS+ https://forensics.wiki/hfs+/
- abrignoni/qnxprobe — MBR/GPT, LVM2 and filesystem reader for raw images (QNX6/QNX4, ETFS, EFS, ext2/3/4, F2FS, FAT32/16/12, exFAT, NTFS, HFS+, APFS, QNX IFS, SquashFS, JFFS2, UBI/UBIFS, YAFFS) https://github.com/abrignoni/qnxprobe
Cite this entry
Crush Format Reference, “HFS Plus / HFSX”. https://kalink0.github.io/crush-forensics/formats/hfs/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction