-
Notifications
You must be signed in to change notification settings - Fork 5
/
hfsinspect.1
150 lines (146 loc) · 4.39 KB
/
hfsinspect.1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
.Dd December 1, 2014
.Dt HFSINSPECT 1
.Os
.Sh NAME
.Nm hfsinspect
.Nd inspect disk structures for HFS+ volumes
.de Nn
Forthcoming.
..
.Sh SYNOPSIS
.Nm
.Op Fl hvDjlrs
.Op Fl d Ar path | Fl V Ar mountpoint
.Op Fl o Ar outpath
.Op Fl b Ar attributes | Ar catalog | Ar extents | Ar hotfile
.Op Fl n Ar nodenum
.Op Fl c Ar cnid | Fl F Ar parent:name
.Op Fl p Ar localpath | Fl P Ar virtualpath
.Sh DESCRIPTION
.Ss GENERAL
.Bl -tag -offset indent -width "123456789012345"
.It Fl h , Cm --help
Show help and quit.
.It Fl v , Cm --version
Show version information and quit.
.El
.Ss SOURCE
.Nm
will use the root filesystem by default, or the filesystem containing a target file in some cases. If you wish to
specify a specific device or volume, you can with the following options:
.Bl -tag -offset indent -width "123456789012345"
.It Fl d , Cm --device Ar DEV
Path to device or file containing an HFS+ filesystem. The source may be either a bare HFS+ filesystem or include a partition map (APT, MBR, or GPT), in which case
.Nm
will use the first HFS+ volume it finds.
.Nm
also fully supports HFSX (both case-preserving and case-sensitive modes) and HFS-wrapped HFS+ volumes.
.It Fl V , Cm --volume Ar VOLUME
Use the path to a mounted disk or any file on the disk to use a mounted volume.
.El
.Ss DISK AND VOLUME INFORMATION
By default,
.Nm
will just show you the volume header and quit. Use the following options to get more specific data about the volume and filesystem.
.Bl -tag -offset indent -width "123456789012345"
.It Fl D , Cm --disk-info
Show any available information about the disk, including partitions and volume headers.
.It Fl r , Cm --volume
Display the HFS Plus volume header.
.It Fl j , Cm --journal
Display the volume's journal structure.
.El
.Ss B-TREE INFORMATION
.Bl -tag -offset indent -width "123456789012345"
.It Fl b , Cm --btree Ar NAME
Specify which HFS+ B-Tree to work with. Supported options: attributes, catalog, extents, or hotfile.
.It Fl n , Cm --node Ar NNUM
Dump an HFS+ B-Tree node by ID (must specify tree with -b).
.El
.Ss FILE AND DIRECTORY INFORMATION
.Bl -tag -offset indent -width "123456789012345"
.It Fl c , Cm --cnid Ar CNID
Lookup and display a record by its catalog node ID.
.It Fl F , Cm --fsspec Ar FSSpec
Lookup and display a record by its FSSpec (
.Ar parentCNID:objectName
).
.It Fl l , Cm --list
If the specified FSOB is a folder, list the contents.
.El
.Ss FORK EXTRACTION
You can optionally have
.Nm
dump any fork it finds as the result of an operation. This includes B-Trees or file forks.
Use a command like "-b catalog -o catalog.dump" to extract the catalog file from the boot drive, for instance.
.Bl -tag -offset indent -width "123456789012345"
.It Fl o , Cm --output Ar PATH
Use with -b or -p to dump a raw data fork (when used with -b, will dump the HFS+ tree file).
.El
.Sh ENVIRONMENT
.Bl -tag -width "NOCOLOR" -offset indent
.It Ev NOCOLOR
Inhibit the use of color in the output (automatically happens when stdout is not a TTY)
.It Ev DEBUG
Feel the firehose.
.El
.\" .Sh FILES
.\" .Bl -tag -width "/usr/local/share/man/man1/hfsinspect.1" -compact
.\" .It Pa /usr/local/bin/hfsinspect
.\" the program
.\" .It Pa /usr/local/share/man/man1/hfsinspect.1
.\" the manpage (this document)
.\" .El
.Sh EXAMPLES
.Nn
.Sh DIAGNOSTICS
.Nn
.\" .Bl -diag
.\" .It Diagnostic Tag
.\" Diagnostic informtion here.
.\" .It Diagnostic Tag
.\" Diagnostic informtion here.
.\" .El
.Sh COMPATIBILITY
.Nn
.Sh SEE ALSO
.Xr diskutil 8 ,
.Xr fdisk 8 ,
.Xr gpt 8 ,
.Xr pdisk 8 ,
.Sh STANDARDS
.Rs
.%T "HFS Plus Volume Format"
.%R "Techincal Note TN1150"
.%J "Apple Developer Connection"
.%Q "Apple Computer, Inc."
.%D "Mar 05, 2004"
.%O https://developer.apple.com/legacy/library/technotes/tn/tn1150.html
.Re
.Sh REFERENCES
.Rs
.%T "Secrets of the GPT"
.%R "Techincal Note TN2166"
.%J "Apple Developer Connection"
.%Q "Apple Computer, Inc."
.%D "Nov 06, 2006"
.%O https://developer.apple.com/library/mac/technotes/tn2166/_index.html
.Re
.Rs
.%T "GUID Partition Table"
.%J Wikipedia
.%O https://en.wikipedia.org/wiki/GUID_Partition_Table
.%D "Nov 16, 2013"
.Re
.Rs
.%T "Apple Partition Map"
.%J Wikipedia
.%O https://en.wikipedia.org/wiki/Apple_Partition_Map
.%D "Sep 16, 2013"
.Re
.Sh HISTORY
.Nn
.Sh AUTHOR
.An "Adam Knight" Aq ahknight@pobox.com
.Sh BUGS
Almost certainly, but at least it's read-only.