New open-source tool: eFFeQuadro, forensic analysis of HFS volumes and Word for Macintosh documents

[Mariangela Giglio]

Dear all,

My name is Mariangela Giglio, and I am a PhD candidate at the University of Bologna (Department of Classical Philology and Italian Studies), where I work on forensic philology applied to born-digital literary archives.

I am writing to share eFFeQuadro, an open-source tool that I developed during my research and have just released. It is designed for the analysis of classic Macintosh media from the 1980s and 1990s, in particular HFS-formatted floppy disks, and of Microsoft Word for Macintosh documents.

What it does:

• reads HFS file system structures (Catalog B-tree, Extents Overflow, allocation bitmap, Master Directory Block) and extracts their metadata, including creation, modification and backup dates of files and folders;
• locates fragments of deleted Word documents in unallocated space and in the Delete-Log;
• extracts hidden text from Word (.mcw) files and compares the first draft preserved in the file with the final version;
• identifies file types and Word versions from their initial signature.

eFFeQuadro works downstream of a standard acquisition workflow: it analyses files extracted from disk images. It is written in Python, has a graphical interface in English and Italian, and runs on Windows, macOS and Linux.

• Code: https://github.com/mariangiglio/eFFeQuadro
• DOI: https://doi.org/10.5281/zenodo.22963345

This is the first public release, so comments, bug reports and tests on collections other than mine are very welcome.

Many thanks,

Mariangela Giglio

Alma Mater Studiorum Università di Bologna
PhD Student - Cultural Heritage in the Digital Ecosystem