{"id":51015058,"url":"https://github.com/securityronin/hfsplus-forensic","last_synced_at":"2026-06-21T09:02:38.083Z","repository":{"id":362470710,"uuid":"1259220641","full_name":"SecurityRonin/hfsplus-forensic","owner":"SecurityRonin","description":"Forensic-grade Apple HFS+/HFSX reader — volume header, catalog B-tree directory listing, and data-fork file extraction","archived":false,"fork":false,"pushed_at":"2026-06-04T10:08:37.000Z","size":19,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-04T12:06:51.750Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SecurityRonin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-04T09:50:45.000Z","updated_at":"2026-06-04T10:09:29.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/SecurityRonin/hfsplus-forensic","commit_stats":null,"previous_names":["securityronin/hfsplus-forensic"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/SecurityRonin/hfsplus-forensic","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fhfsplus-forensic","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fhfsplus-forensic/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fhfsplus-forensic/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fhfsplus-forensic/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SecurityRonin","download_url":"https://codeload.github.com/SecurityRonin/hfsplus-forensic/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fhfsplus-forensic/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34603640,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-21T02:00:05.568Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-21T09:02:33.509Z","updated_at":"2026-06-21T09:02:38.073Z","avatar_url":"https://github.com/SecurityRonin.png","language":"Rust","funding_links":["https://github.com/sponsors/h4x0r"],"categories":[],"sub_categories":[],"readme":"[![Crates.io](https://img.shields.io/crates/v/hfsplus-forensic.svg)](https://crates.io/crates/hfsplus-forensic)\n[![docs.rs](https://img.shields.io/docsrs/hfsplus-forensic)](https://docs.rs/hfsplus-forensic)\n[![License: Apache-2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)\n[![CI](https://github.com/SecurityRonin/hfsplus-forensic/actions/workflows/ci.yml/badge.svg)](https://github.com/SecurityRonin/hfsplus-forensic/actions)\n[![Sponsor](https://img.shields.io/badge/sponsor-h4x0r-ea4aaa?logo=github-sponsors)](https://github.com/sponsors/h4x0r)\n\n**Pure-Rust forensic Apple HFS+/HFSX reader — volume-header geometry, catalog B-tree directory listing, and data-fork file extraction from a byte buffer.**\n\nBuilt for parsing the HFS/HFS+ side of Apple hybrid optical discs and HFS+ volumes, with no `unsafe` and no allocations beyond the data it returns.\n\n## Install\n\n```toml\n[dependencies]\nhfsplus-forensic = \"0.1\"\n```\n\n## Quick start\n\n```rust\n// `volume` is the whole HFS+ volume (its header is at offset 1024).\nlet volume: Vec\u003cu8\u003e = std::fs::read(\"hfsplus.img\")?;\n\nif let Some(v) = hfsplus_forensic::parse(\u0026volume) {\n    println!(\"{:?}  {} blocks x {} bytes\", v.kind, v.total_blocks, v.block_size);\n\n    for e in hfsplus_forensic::list_root(\u0026volume).unwrap_or_default() {\n        println!(\"  {}  {}\", if e.is_dir { \"dir \" } else { \"file\" }, e.name);\n        if !e.is_dir {\n            let bytes = hfsplus_forensic::read_file(\u0026volume, e.cnid);\n            println!(\"    {} bytes\", bytes.map(|b| b.len()).unwrap_or(0));\n        }\n    }\n}\n```\n\n## What it parses\n\n| Capability | Notes |\n|---|---|\n| Volume header | `H+` / `HX` signature, version, allocation block size, block counts |\n| Root + directory listing | catalog B-tree leaf walk; `list_dir(parent_cnid)` for any folder |\n| File extraction | data-fork extents, truncated to the logical size |\n\nGeometry and listing only; on-disk journal replay and resource-fork specifics are out of scope.\n\n## Validation\n\nEvery capability is checked against **real Apple-produced bytes**, not hand-built fixtures. The HFS+ reader (header geometry, catalog listing, data-fork extraction) runs against **real `hdiutil`-created volumes**. The `decmpfs` transparent-compression codecs are validated against **real `ditto --hfsCompression` / `afsctool` forks** — and on a clean **macOS 26.5 (Tahoe)** system, with Apple's own `compression_decode_buffer` as the answer key — so LZVN, zlib, and LZFSE are each decoded and matched against the original pre-compression file.\n\nFull oracle-by-oracle, corpus-by-corpus evidence (and the honest gaps — the HFS+ reader is not yet cross-checked against The Sleuth Kit): [securityronin.github.io/hfsplus-forensic/validation](https://securityronin.github.io/hfsplus-forensic/validation/).\n\n## Related\n\nPart of the [Security Ronin](https://github.com/SecurityRonin) forensic toolkit. Sibling filesystem readers: [`ext4fs-forensic`](https://github.com/SecurityRonin/ext4fs-forensic), [`ntfs-forensic`](https://github.com/SecurityRonin/ntfs-forensic), [`udf-forensic`](https://github.com/SecurityRonin/udf-forensic); partition maps: [`apm-forensic`](https://github.com/SecurityRonin/apm-forensic), [`gpt-forensic`](https://github.com/SecurityRonin/gpt-forensic), [`mbr-forensic`](https://github.com/SecurityRonin/mbr-forensic). Consumed by [`iso9660-forensic`](https://github.com/SecurityRonin/iso9660-forensic) for Apple hybrid discs.\n\n---\n\n[Privacy Policy](https://securityronin.github.io/hfsplus-forensic/privacy/) · [Terms of Service](https://securityronin.github.io/hfsplus-forensic/terms/) · © 2026 Security Ronin Ltd\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Fhfsplus-forensic","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecurityronin%2Fhfsplus-forensic","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Fhfsplus-forensic/lists"}