<?xml version="1.0" encoding="UTF-8"?><rss version="0.92">
<channel>
	<title>Mac OS X Internals</title>
	<link>http://osxbook.com/blog</link>
	<description>A Systems Approach</description>
	<lastBuildDate>Fri, 30 Sep 2011 07:20:48 +0000</lastBuildDate>
	<docs>http://backend.userland.com/rss092</docs>
	<language>en</language>
	<!-- generator="WordPress/3.2.1" -->

	<item>
		<title>fileXray and Newer HFS+ Features</title>
		<description><![CDATA[In case you were wondering, fileXray (make sure you have a recent version) does support newer HFS+ features such as: The &#8220;date-added&#8221; information stored in Finder Info, which is not the same as the older &#8220;creation-time&#8221; field in the stat structure. fileXray will determine if a file or folder has this information set, and if [...]]]></description>
		<link>http://osxbook.com/blog/2011/09/29/filexray-and-newer-hfs-features/</link>
			</item>
	<item>
		<title>fileXray vs hfsdebug</title>
		<description><![CDATA[I&#8217;ve been asked how fileXray is better than hfsdebug. Here goes: The primary answer is that it is not meaningful to compare them. Dramatically speaking, hfsdebug is the tip to the iceberg that is fileXray. It would be contrived to say that a bicycle is similar to a fighter jet because they both have wheels [...]]]></description>
		<link>http://osxbook.com/blog/2011/04/17/filexray-vs-hfsdebug/</link>
			</item>
	<item>
		<title>Using fileXray to Enumerate Orphaned Files</title>
		<description><![CDATA[fileXray&#8217;s goal is to help you determine &#8220;anything&#8221; and &#8220;everything&#8221; about an HFS+ volume. Someone recently asked if it is possible to locate all orphaned files on a volume. Indeed, it is possible. HSF+ allows you to unlink a file or a folder while it is busy. Normally, these are permanently removed at unmount time. [...]]]></description>
		<link>http://osxbook.com/blog/2011/02/18/using-filexray-to-enumerate-orphaned-files/</link>
			</item>
	<item>
		<title>Advanced HFS+ Forensics and Content Recovery</title>
		<description><![CDATA[Besides its other capabilities, fileXray has an extensive feature set geared for HFS+ file system forensics. This is a quick overview of the relevant features&#8212;details can be found in the fileXray User Guide and Reference ebook. To begin with, the --disallow_mounting option provides a convenient solution to an often cited problem: that of preventing volumes [...]]]></description>
		<link>http://osxbook.com/blog/2010/11/22/advanced-hfs-forensics-and-content-recovery/</link>
			</item>
	<item>
		<title>fileXray Example: The Mach-O Filter</title>
		<description><![CDATA[fileXray contains over two dozen built-in &#8220;filters&#8221 that allow you to locate file system objects on an HFS+ volume using a variety of criteria. A filter is a piece of code that gets executed by fileXray for each file system object as fileXray rapidly runs through the entire file system hierarchy of an HFS+ volume. [...]]]></description>
		<link>http://osxbook.com/blog/2010/11/15/filexray-example-the-mach-o-filter/</link>
			</item>
	<item>
		<title>fileXray Example: FreespaceFS</title>
		<description><![CDATA[In a previous blog post we saw how the trawling mechanism in fileXray provides a way of looking for patterns on an HFS+ volume. There are times when you really must be able to just manually &#8220;go through&#8221; the free (unallocated) space in a volume. Perhaps you are an end user who wants to look [...]]]></description>
		<link>http://osxbook.com/blog/2010/11/11/filexray-example-freespacefs/</link>
			</item>
	<item>
		<title>fileXray Example: Disallowing Automatic Mounting</title>
		<description><![CDATA[By default, the Disk Arbitration mechanism in Mac OS X probes newly discovered storage devices for mountable volumes. Mounting an HFS+ volume in read-write mode, which is the default, will modify the volume in question because both low-level and high-level file system activity can occur at mount time. For example, timestamps and counters can get [...]]]></description>
		<link>http://osxbook.com/blog/2010/11/10/filexray-example-disallowing-automatic-mounting/</link>
			</item>
	<item>
		<title>fileXray Example: ArbitraryFS</title>
		<description><![CDATA[One of fileXray&#8217;s features is that it uses virtual file systems to provide access to certain types of volume information. The Trawling for Data blog post contained a mention of ArbitraryFS, which is one of the several such file systems built into fileXray. Let us look at ArbitraryFS in a little more detail. ArbitraryFS contains [...]]]></description>
		<link>http://osxbook.com/blog/2010/11/08/filexray-example-arbitraryfs/</link>
			</item>
	<item>
		<title>fileXray Example: Trawling for Data</title>
		<description><![CDATA[fileXray provides several ways of looking for elusive or missing data on an HFS+ volume. One of these ways is fileXray&#8217;s trawling mechanism, wherein it will scan a volume looking for blocks that match &#8220;magic&#8221; patterns (signatures) contained in a given query file. You don&#8217;t usually need to come up with the patterns&#8212;fileXray understands the [...]]]></description>
		<link>http://osxbook.com/blog/2010/11/05/filexray-example-trawling-for-data/</link>
			</item>
	<item>
		<title>fileXray Example: Who Owns This Byte?</title>
		<description><![CDATA[Suppose you want to know which file or folder (if any) &#8220;owns&#8221; a given byte on an HFS+ volume. If no regular file or folder owns the byte, is the byte part of a free block, or is it allocated to some internal file system data structure, such as the HFS+ Catalog B-Tree, etc.? There [...]]]></description>
		<link>http://osxbook.com/blog/2010/11/04/filexray-example-who-owns-this-byte/</link>
			</item>
</channel>
</rss>

