HFS+ compressed files appear as 0 KB

Files inside an disk image containing an HFS+ filesystem appear as 0 KB when mounted in Disk Decipher. The same image mounts and displays correctly on macOS, indicating the image itself is not corrupted.

Observed behavior

  • Image mounts successfully in the app.
  • When opening certain folders, many files appear with size 0 KB.
  • Other files in the same image open normally.
  • The issue is visible immediately when browsing the folder (not only when opening the file).

Expected behavior

Files should show their correct size and contents as seen when the same image is mounted on macOS.

Investigation so far

Initial testing suggests this happens when files are stored using HFS+ filesystem compression.

Reproducing locally:

  1. Create files on macOS.
  2. Enable HFS+ file compression on those files.
  3. Mount the image using Disk Decipher.
  4. Files appear with empty data forks and size 0 KB.

This matches the HFS+ compression design, where:

  • The data fork is cleared
  • Actual file data is stored in compression structures (typically in the resource fork or extended attributes)

The current HFS+ read-only driver reads only the data fork, which results in compressed files appearing empty.

Testing with the licensed HFS+ driver shows the same behavior.

Workarounds

For affected users:

  • Mount the image on macOS and convert the filesystem to APFS using Disk Utility.
  • APFS compression is supported by Disk Decipher even in read-only mode.

References

https://wiki.sleuthkit.org/index.php?title=HFS
(the HFS+ File Compression section)