| Author | Message | ||
     geek911 Username: geek911 Registered: N/A |
Trying to use X-ways to examine an HFS+ volume. When I highlight a file name in the tree then click on the details tab below, among the information displayed is an ID field. Is this the unique catalog node file id assigned by HFS+? If not, where can I find this information? Is there an easy way to view the catalog file in X-ways or do I have to manually translate the information? | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
> When I highlight a file name in the tree (in what in X-Ways Forensics is called the directory browser) > among the information displayed is an ID field Can also be seen in the ID column which is optionally available. Details mode is just an overview of all information from all columns, including hidden columns. > Is this the unique catalog node file id assigned by HFS+? Yes, it is. > Is there an easy way to view the catalog file in X-ways You can view it by selecting it in the directory browser (it's shown in the root directory) in File mode. > or do I have to manually translate the information? No. Even if it was not possible to view the catalog file in X-Ways Forensics, the entire volume snapshot = the database of all files and directories that X-Ways Forensics shows in an HFS+ volume obviously is already a translation of all the information in the Catalog file, and you can conveniently right-click any file or directory and use the Position submenu to navigate to the Catalog Key where it is defined. |