pytsk/libtsk does not correctly/fully handle HFS+/HFSX

[joachimmetz]

• HFS+: istat replaces U+2400 with ^ (likely because it assumes it is U+0) sleuthkit/sleuthkit#2057 The behavior of how U+2400 is handled for HFS+ by native Mac OS and pytsk/libtsk differs.
• HFS+/HFSX: istat errors with misleading/incorrect message for kHFSPlusAttrForkData attribute record sleuthkit/sleuthkit#2494 kHFSPlusAttrForkData attribute record is not handled and instead assumes corruption
• HFS+/HFSX: istat yields "Error reading file data fork" for block or character device and FIFO file entry sleuthkit/sleuthkit#2720 certain types of file entry types are not handled correctly
• Incorrect link count for character and block device file entries - HFS+/HFSX: istat yields "Error reading file data fork" for block or character device and FIFO file entry sleuthkit/sleuthkit#2720
• libtsk handles HFS+ wrapped in HFS but does not appear to expose files in the (traditional) HFS volume fsstat provides -f hfsl but then does not support it? sleuthkit/sleuthkit#3526
• certain directories cannot be read fls on HFS+ fails with "hfs_dir_open_meta: nodesize value out of bounds" sleuthkit/sleuthkit#3527
• libtsk does not support decmpfs compression types 11 and 12 icw HFS+, see below

[joachimmetz]

# istat hfsplus.raw 40
File Path: /testdir1/compressed5
Catalog Record: 40
Allocated
Type:	File
Mode:	rrw-r--r--
Size:	19
uid / gid: 501 / 20
Link count:	1

File Name: compressed5
Admin flags: 0
Owner flags: 32 - compressed 
Has extended attributes
File type:	0000      
File creator:	0000      
Text encoding:	0 = MacRoman
Resource fork size:	0

Times:
Created:	2026-08-01 11:43:28 (CEST)
Content Modified:	2026-08-01 11:43:28 (CEST)
Attributes Modified:	2026-08-01 11:43:28 (CEST)
Accessed:	2026-08-01 11:43:28 (CEST)
Backed Up:	0000-00-00 00:00:00 (UTC)

Attributes: 
Type: CMPF (4355-2)   Name: com.apple.decmpfs   Resident   size: 47

Compressed File:
    Uncompressed size: 19
    Compression type is 11: UNKNOWN

# istat hfsplus.raw 41
File Path: /testdir1/compressed6
Catalog Record: 41
Allocated
Type:	File
Mode:	rrw-r--r--
Size:	11358
uid / gid: 501 / 20
Link count:	1

File Name: compressed6
Admin flags: 0
Owner flags: 32 - compressed 
Has extended attributes
File type:	0000      
File creator:	0000      
Text encoding:	0 = MacRoman
Resource fork size:	4089

Times:
Created:	2026-07-14 09:34:31 (CEST)
Content Modified:	2026-07-14 09:34:31 (CEST)
Attributes Modified:	2026-08-01 11:43:28 (CEST)
Accessed:	2026-07-14 10:02:53 (CEST)
Backed Up:	0000-00-00 00:00:00 (UTC)

Resource Fork Blocks:
285  

Attributes: 
Type: CMPF (4355-2)   Name: com.apple.decmpfs   Resident   size: 16
Type: RSRC (4353-1)   Name: RSRC   Non-Resident   size: 4089  init_size: 4089

Compressed File:
    Uncompressed size: 11358
    Compression type is 12: UNKNOWN