Today we discussed the GUID Partitioning (GPT) scheme, which is used on OS X systems, among others. We also discussed Apple's current file system, Hierarchical File System Plus (HFS+). One detail I mentioned that seems to be written down only rarely: GUID stands for Globally Unique Identifier.Our review of GPT was pretty cursory. It focused mostly on the type of metadata present. Our review of HFS+ focused on the data structures used and the overall organization. There is no need to have the details committed to memory, because they can always be referenced. The important thing to understand is the overall organization and the types of information of forensic value that is, or at least might be, present.
The best resources for the details are here:
Warning to all Readers
These are unrefined notes. They are not published documents. They are not citable. They should not be relied upon for forensics practice. They do not define any legal process or strategy, standard of care, evidentiary standard, or process for conducting investigations or analysis. Instead, they are designed for, and serve, a single purpose, to help students to jog their memory of classroom discussions and assist them in thinking critically about the issues presented. The author is certainly not an attorney and is absolutely not giving any legal advice.