If you mount the Recovery HD that enables OS X Lion File Vault 2, Safari mode, and certain recovery options, you see several
.efires files. What format are those and what do they contain?
These files contain resources required for displaying the boot screen of OS X Lion before loading the actual operating system or in cases there is no system partition (or when it's broken).
They contain a flat list of files (no hierarchy), and each file has a name of up to 64 characters. The file format is as follows; all numbers are little endian, i.e. least significant byte first.
The first file's data offset in e.g. an archive file with 56 entries is
2 bytes unknown + 2 bytes file count + (56+1 file entries) * 72 bytes each = 4108.
The second file's data offset in the same file is 4108 plus the length of the first file's data.
These files are recreated automatically whenever you change a setting relevant for the boot login screen, e.g. whether to enable Safari mode in Security & Privacy preference pane in System Preferences). It uses default system resources to do this, so if you want to change e.g. the Apple icon, it is sufficient to edit the regular resource and have the system recreate the corresponding