Add XML namespace: HFS

[dd388]

The following attributes appear to be unique to HFS filesystems that would benefit from a separate namespace as they currently do not have a logical home within the existing DFXML elements.

1. File is "invisible" (yes/no flag)
2. File is "locked" (yes/no flag)
3. Size of resource fork (integer)
4. File type and creator code (two sets of four alphanumeric characters separated by a forward slash)

More information on the file type and creator codes:

• https://en.wikipedia.org/wiki/Type_code
• http://revolution.byu.edu/helps/file-creatorcodes.php
• http://web.archive.org/web/20101130093642/http://www.file-making.com/files/no.comitas.ext/AppleVolumes.system_276

[ajnelson-nist]

Those are handy references. I'm surprised the Wikipedia page doesn't need disambiguation links.

Would a namespace of http://www.forensicswiki.org/wiki/HFS work? (That wiki page currently redirects to HFS+'s page, but a set of HFS reference data or xml can motivate an HFS page.)

[dd388]

http://www.forensicswiki.org/wiki/HFS would work.

HFS and HFS+ volumes do share certain properties (e.g., resource forks) and it might be worth using the same namespace to refer to either of these filesystems, since that is the convention used by TSK. (See: http://wiki.sleuthkit.org/index.php?title=HFS)

[ajnelson-nist]

I stumbled on another facet of HFS when testing the Disktype translator. An HFS file system can wrap an HFS+ file system. (Example.)

[dd388]

I found the disktype writeup of this phenomenon here: http://disktype.sourceforge.net/doc/ch03s02.html