Lets say you come across a hard drive that is HFSX formatted. Your using Encase to view the drive but you cant. That’s because EnCase doesn’t support HSFX for some reason (only HFS and HFS plus). Well, all you have to do is convert the acquired image to a hfs+. Shouldn’t be that hard!! It may not be forensically sound, but at least you have something to look at!
Make sure the forensic image is a DD image. If its a e01, you will need to convert it to DD.
Open the DD image using a hex editing software. (i use winhex)
Change HX to H+
Change the 4th byte from 05 to 04
Save your work!! open it up using your favorite forensic tool and bam!
If you need to, you can reacquire it to a e01 image and your all set!