View and export information from HFS-formatted disk images
This utility allows you to view the contents of and detailed information on HFS-formatted disk image files, as well as extract files from those images to the BitCurator environment. HFS is a proprietary file system developed by Apple Inc. for use in computer systems running Mac OS. The HFS Explorer is included in the BitCurator environment because many of BitCurator's features (such as Sleuth Kit tools like fiwalk, which is used to generate DFXML output) cannot currently read HFS-formatted disks.
To use HFS Explorer, first image the disk using Guymager as described in this tutorial.
View and export information from HFS-formatted disk images using HFS Explorer
Open the tool by double clicking on the "Additional Tools" folder on the BitCurator desktop and then double clicking on the "HFS Explorer" icon (see Figure 1).
The HFS Explorer window will open. Click on the "File" menu item in the top left corner of the window, and then choose "Load file system from file" (see Figure 2).
Choose the file you wish to explore, and click "OK" (see Figure 3).
Note: If the file you chose isn't one of the supported file types (HFS, HFS+, HFSX), you'll receive an error message (see Figure 4).
Choose a file in the list and click the "Info" button for more information on a file (see Figure 5).
You can now view a summary of basic information about the file, such as when the file was last modified (see Figure 6). To view more detailed information about the file, choose the "Detailed" tab in the top of the window (see Figure 7).
To extract files in the HFS-formatted disk to the BitCurator environment, in the main HFS Explorer screen, choose the files you wish to extract and then click the "Extract" button at the top left of the window (see Figure 8).
Navigate to the directory to which you wish to extract the file(s) and click on the "Extract here" button on the lower left (see Figure 9).
A pop-up will appear asking whether you wish to follow symbolic links when extracting; click the "Yes" button (see Figure 10).
A pop-up will inform you when the extraction is finished (see Figure 11). You can navigate to the extraction directory you specified in Step 7 to view your extracted files (in this example, we extracted a number of files to our desktop; see Figure 12).