Apple Volume Header
Previous Topic  Next Topic 

Home


This sector is normally 2 sectors after the start of the partition - for HFS Plus disks, it always starts with 'H+'.  A typical sector number for this sector is 0x6402a



00000000   48 2B 00 04 00 00 60 00 - 48 46 53 4A 00 00 AF 01    H+   ` HFSJ  ¯

00000010   C1 E6 80 12 CC 0E 49 C7 - 00 00 00 00 C1 E6 F0 92    Áæ€ÌIÇ    Áæð

00000020   00 0A F3 E1 00 02 6E AD - 00 00 10 00 00 DE 47 86      óá n­    ÞG†

00000030   00 1C DB D5 00 75 68 12 - 00 01 00 00 00 01 00 00     ÛÕ uh     

00000040   00 BE 3E C1 29 C9 26 0B - 00 00 00 00 02 00 00 8B     ¾>Á)É&       ‹

00000050   00 00 0C 8A 00 9B 1A 14 - 00 00 00 00 00 00 00 00       Š ›       

00000060   00 00 00 00 00 00 0C 8A - 19 BD 42 F8 8A 51 5A 3A           Š½BøŠQZ:

00000070   00 00 00 00 00 80 00 00 - 00 1B D0 00 00 00 08 00         €   Р  

00000080   00 00 00 01 00 00 08 00 - 00 00 00 00 00 00 00 00                 

00000090   00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00                   

000000A0   00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00                   

000000B0   00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00                   

000000C0   00 00 00 00 00 50 00 00 - 00 60 00 00 00 00 05 00         P   `    

000000D0   00 00 08 01 00 00 05 00 - 00 00 00 00 00 00 00 00                

000000E0   00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00                   

000000F0   00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00                   

00000100   00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00                   

00000110   00 00 00 00 17 60 00 00 - 01 30 00 00 00 01 76 00        `  0   v

00000120   00 00 0D 01 00 00 9A 00 - 00 01 3D D2 00 00 0E 00         š  =Ò  

00000130   00 41 06 D3 00 00 A8 00 - 00 6B D0 45 00 00 13 00     AÓ  ¨  kÐE  

00000140   00 93 92 4F 00 00 13 00 - 00 00 00 00 00 00 00 00     “’O          

00000150   00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00                   

00000160   00 00 00 00 00 7F 00 00 - 01 30 00 00 00 00 07 F0           0    ð

00000170   00 4F E8 87 00 00 07 F0 - 00 00 00 00 00 00 00 00     O臠 ð       

00000180   00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00                   


The sector is extremely important for recovery as it has pointers to bioth the catalog, and extents table.  It also has the basic information regarding cluster sizes.  The sector is normally duplicated near the end of the partition


Important fields in the volume header


Bytes 0x00-0x01                Signature, H+

Bytes 0x02-0x03                Version, 0x4


Bytes 0x10-0x13                Create date

Bytes 0x14-0x17                Modify date

Bytes 0x18-0x1B                Backup date

Bytes 0x1c-0x1F                Checked date


Bytes 0x20-0x23                File count

Bytes 0x24-0x27                Folder count

Bytes 0x28-0x2B                Block size, typical 0x1000

Bytes 0x2c-0x2F                Total blocks


Bytes 0x30-0x33                Free blocks

Bytes 0x38-0x3B                Resource clump size

Bytes 0x3C-0x3F                Data clump size



Bytes 0xc0-0x10f                Extents file locations

Bytes 0x110-0x15f        Catalog file locations