Book Image

Practical Mobile Forensics - Second Edition

By : Heather Mahalik, Rohit Tamma, Satish Bommisetty
Book Image

Practical Mobile Forensics - Second Edition

By: Heather Mahalik, Rohit Tamma, Satish Bommisetty

Overview of this book

Mobile phone forensics is the science of retrieving data from a mobile phone under forensically sound conditions. This book is an update to Practical Mobile Forensics and it delves into the concepts of mobile forensics and its importance in today's world. We will deep dive into mobile forensics techniques in iOS 8 - 9.2, Android 4.4 - 6, and Windows Phone devices. We will demonstrate the latest open source and commercial mobile forensics tools, enabling you to analyze and retrieve data effectively. You will learn how to introspect and retrieve data from cloud, and document and prepare reports for your investigations. By the end of this book, you will have mastered the current operating systems and techniques so you can recover data from mobile devices by leveraging open source solutions.
Table of Contents (19 chapters)
Practical Mobile Forensics - Second Edition
Credits
About the Authors
About the Reviewer
www.PacktPub.com
Preface

The HFS Plus file system


In 1996, Apple developed a new file system, Hierarchical File System (HFS), to accommodate the storage of large datasets. In an HFS file system, the storage medium is represented as volumes. HFS volumes are divided into logical blocks of 512 bytes. The logical blocks are numbered from first to last on a given volume and will remain static with the same size as physical blocks, that is, 512 bytes. These logical blocks are grouped together into allocation blocks, which are used by the HFS file system to track data in a more efficient way. HFS uses a 16-bit value to address allocation blocks, which limits the number of allocation blocks to 65,535. To overcome the inefficient allocations of disk space and some of the limitations of HFS, Apple introduced the HFS Plus file system (http://dubeiko.com/development/FileSystems/HFSPLUS/tn1150.html).

The HFS Plus file system was designed to support larger file sizes. HFS volumes are divided into sectors that are usually 512 bytes...