guide to computer forensics and investigations, second edition chapter 8 macintosh and linux boot...

Guide to Computer Guide to Computer Forensics and Forensics and Investigations, Investigations, Second EditionSecond Edition

Chapter 8Macintosh and Linux Boot Processes

and File Systems

Guide to Computer Forensics and Investigations, 2e 2

ObjectivesObjectives

• Understand Macintosh file structures

• Explore Macintosh boot tasks

• Examine UNIX and Linux disk structures

Guide to Computer Forensics and Investigations, 2e 3

Objectives (continued)Objectives (continued)

• Understand UNIX and Linux boot processes

• Examine CD data structures

• Understand other disk structures

Guide to Computer Forensics and Investigations, 2e 4

Understanding the Macintosh File Understanding the Macintosh File StructureStructure

• Mac OS X version 10.3– Darwin core– BSD UNIX application layer

• Hierarchical File System (HFC)– Extended Format (HFC+)

• File Manager and Finder

• Data fork and resource fork

Guide to Computer Forensics and Investigations, 2e 5

Understanding the Macintosh File Understanding the Macintosh File Structure (continued)Structure (continued)

Guide to Computer Forensics and Investigations, 2e 6

Understanding VolumesUnderstanding Volumes

• Storage medium used to store files

• A volume can be all or part of a hard disk– On a floppy disk, is always the entire disk

• Multiple clients per volume

• Allocation and logical blocks– Logical blocks cannot exceed 512 bytes– Allocation blocks are a set of logical blocks

Guide to Computer Forensics and Investigations, 2e 7

Understanding Volumes (continued)Understanding Volumes (continued)

Guide to Computer Forensics and Investigations, 2e 8

Understanding Volumes (continued)Understanding Volumes (continued)

• Two EOF descriptors– Logical EOF– Physical EOF

• Clumps– Groups of contiguous allocation blocks– Reduce fragmentation

Guide to Computer Forensics and Investigations, 2e 9

Understanding Volumes (continued)Understanding Volumes (continued)

Guide to Computer Forensics and Investigations, 2e 10

Exploring Macintosh Boot TasksExploring Macintosh Boot Tasks

• Use Open Firmware– Processor- and system-independent firmware

• Older Macintosh OSs– First two logical blocks are boot blocks– Master Directory Block (MDB) or Volume Information

Block (VIB)– Extents overflow file– Volume Control Block (VCB)

Guide to Computer Forensics and Investigations, 2e 11

Exploring Macintosh Boot Tasks Exploring Macintosh Boot Tasks (continued)(continued)

• Volume Bitmap– Tracks used and unused blocks on a volume

• Mac OS 9 uses a B*-tree file system for File Manager– Actual file data is stored on the leaf nodes– Header, index, and map nodes

Guide to Computer Forensics and Investigations, 2e 12

Using Macintosh Forensic SoftwareUsing Macintosh Forensic Software

• For Mac OSs earlier that Mac OS x– Expert Witness originally from ASRData, now owned

by Guidance Software– Black Bag Technologies tools

• Deal specifically with files Macintosh hides

• PhantomSearch

• For Mac OS X– Almost any UNIX/Linux forensic tool

Guide to Computer Forensics and Investigations, 2e 13

Examining UNIX and Linux Disk Examining UNIX and Linux Disk StructuresStructures

• UNIX flavors– System 7, SGI IRIX, Sun Solaris, IBM AIX, and HP-

UX– BSD, FreeBSD, OpenBSD, and NetBSD

• Linux distributions– Caldera, Red Hat, SuSe, Mandrake, and Debian– Most consistent UNIX-like OSs

• GNU and BSD licenses

Guide to Computer Forensics and Investigations, 2e 14

Examining UNIX and Linux Disk Examining UNIX and Linux Disk Structures (continued)Structures (continued)

Guide to Computer Forensics and Investigations, 2e 15

Examining UNIX and Linux Disk Examining UNIX and Linux Disk Structures (continued)Structures (continued)

Guide to Computer Forensics and Investigations, 2e 16

Examining UNIX and Linux Disk Examining UNIX and Linux Disk Structures (continued)Structures (continued)

• Linux file systems– Second Extended File System (Ext2fs)– Ext3fs, journaling version of Ext2fs

• Employs inodes– Pointer to other inodes or blocks– Keep internal link count

• Deleted inodes have count value 0

• Linux file structure– Meta-data and data

Guide to Computer Forensics and Investigations, 2e 17

Examining UNIX and Linux Disk Examining UNIX and Linux Disk Structures (continued)Structures (continued)

Guide to Computer Forensics and Investigations, 2e 18

UNIX and Linux OverviewUNIX and Linux Overview

• Everything is a file– Files are defined as objects

• UNIX consists of four components

• Boot block– Disk allocation unit of at least 512 bytes– Contains the bootstrap code– Only one

Guide to Computer Forensics and Investigations, 2e 19

UNIX and Linux Overview (continued)UNIX and Linux Overview (continued)

• Superblock– Indicates disk geometry, available space, and

location of the first inode– Manages the file system

• Inode blocks– First data after the superblock– Assigned to every file allocation unit

• Data blocks– Where directories and files are stored

Guide to Computer Forensics and Investigations, 2e 20

UNIX and Linux Overview (continued)UNIX and Linux Overview (continued)

Guide to Computer Forensics and Investigations, 2e 21

UNIX and Linux Overview (continued)UNIX and Linux Overview (continued)

• Bad block inode– Keeps track of disk bad sectors– Commands: badblocks, mke2fs, and E2fsck/

• Linux ls command displays information about files

• Continuation inode provides more information about a file or directory

Guide to Computer Forensics and Investigations, 2e 22

UNIX and Linux Overview (continued)UNIX and Linux Overview (continued)

Guide to Computer Forensics and Investigations, 2e 23

UNIX and Linux Overview (continued)UNIX and Linux Overview (continued)

Guide to Computer Forensics and Investigations, 2e 24

Understanding InodesUnderstanding Inodes

• Link data stored in data blocks

• Ext2fs and Ext3fs are improvements over Ext– Data recovery easier on Ext3fs than on Ext2fs

• First inode has 13 pointers– Pointers 1 to 10 are direct pointers– Pointer 11 is an indirect pointer– Pointer 12 is a double-indirect pointer– Pointer 13 is a triple-indirect pointer

Guide to Computer Forensics and Investigations, 2e 25

Understanding Inodes (continued)Understanding Inodes (continued)

Guide to Computer Forensics and Investigations, 2e 26

Understanding Inodes (continued)Understanding Inodes (continued)

Guide to Computer Forensics and Investigations, 2e 27

Understanding UNIX and Understanding UNIX and Linux Boot ProcessesLinux Boot Processes

• Instruction code in firmware is loaded into RAM

• Instruction code then– Checks the hardware– Load the boot program

• Boot program – Loads kernel – Transfers control to kernel

Guide to Computer Forensics and Investigations, 2e 28

Understanding UNIX and Understanding UNIX and Linux Boot Processes (continued)Linux Boot Processes (continued)

• Kernel– Boots system on single-user mode– Runs startup scripts– Changes to multiuser mode– Identifies root directory, swap and dump files– Sets host name, time zone– Runs consistency checks on the file system and

mounts partitions– Starts services

Guide to Computer Forensics and Investigations, 2e 29

Understanding Linux Loader Understanding Linux Loader and GRUBand GRUB

• Linux Loader (LILO) – Old boot manager– Can start two or more OSs– Uses configuration file lilo.conf

• Grand Unified Boot Loader (GRUB)– More powerful than LILO– As LILO resides on MBR– Command line or menu driven

Guide to Computer Forensics and Investigations, 2e 30

UNIX and Linux Drives and Partition UNIX and Linux Drives and Partition SchemesSchemes

• Labeled as path starting at root (/) directory– Primary master disk

• First partition is /dev/hda

• Second partition is /dev/hda2

– Primary slave or secondary master or slave• First partition is /dev/hdb

– SCSI controllers• /dev/sda with first partition /dev/sda1

Guide to Computer Forensics and Investigations, 2e 31

Examining CD Data StructuresExamining CD Data Structures

• Laser burns flat areas (lands)

• Lower areas are called pits

• Transitions – From lands to pits have binary value 1, or on– No transition has binary value 0, or off

• ISO standards– ISO 9660 for CD, CD-R, and CD-RW– ISO 13346 for DVDs

Guide to Computer Forensics and Investigations, 2e 32

Examining CD Data Structures Examining CD Data Structures (continued)(continued)

Guide to Computer Forensics and Investigations, 2e 33

Examining CD Data Structures Examining CD Data Structures (continued)(continued)

Guide to Computer Forensics and Investigations, 2e 34

Examining CD Data Structures Examining CD Data Structures (continued)(continued)

• Frame is the unit storage– Contains 24 17-bit symbols

• Frames are combined into blocks

• Blocks are combined into sectors– 2352 bytes for CD-DA– 2048 bytes for CD

• Constant Linear Velocity (< 12X)

• Constant Angular Velocity (>= 12X)

Guide to Computer Forensics and Investigations, 2e 35

Understanding Other Disk StructuresUnderstanding Other Disk Structures

• SCSI disks

• IDE/EIDE disks

• RAID configurations

Guide to Computer Forensics and Investigations, 2e 36

Examining SCSI DisksExamining SCSI Disks

• SCSI– Provides a common bus communication device

• During investigation– Check if the device is internal or external– Check if card, cables, adapters, terminators, and

drivers are available– Advance SCSI Programming Interface (ASPI)

• Might need to adjust settings– Port numbers and terminators

Guide to Computer Forensics and Investigations, 2e 37

Examining IDE/EIDE DevicesExamining IDE/EIDE Devices

• ATA drives from ATA-33 to ATA-133– Standard 40-pin ribbon or shielded cable– 40-pin/80-wire cable for ATA-66, 100, and 133

• CMOS identifies proper disk settings– Logical block addressing (LBA)– Enhanced CHS configurations– Can pose a problem during an investigation

Guide to Computer Forensics and Investigations, 2e 38

Examining IDE/EIDE DevicesExamining IDE/EIDE Devices

• Solutions– Disk imaging tools– Old PC– Cards and adapters

• ISA SCSI card

• A-Card IDE adapter

• SCSI-to-IDE adapter

• EISA FireWire card

• FireWire-to-EIDE adapter

Guide to Computer Forensics and Investigations, 2e 39

Examining the IDE Host Protected Examining the IDE Host Protected AreaArea

• ATAPI-5 AT introduced in 1998 reserved and protected areas on IDE devices– Protected Area Run Time Interface Extension

Service (PARTIES)

• Contains data stored by diagnostic and restore programs

• Tools– Area 51– BIOS, XBIOS Direct Access Reporter (BXDR)

Guide to Computer Forensics and Investigations, 2e 40

Understanding RAIDUnderstanding RAID

• RAID 0– Provides rapid access and increased storage– Lack of redundancy

• RAID 1– Designed for data recovery– More expensive than RAID 0

• RAID 2– Data is written to a disk on a bit level– Slower than RAID 0

Guide to Computer Forensics and Investigations, 2e 41

Understanding RAID (continued)Understanding RAID (continued)

Guide to Computer Forensics and Investigations, 2e 42

Understanding RAID (continued)Understanding RAID (continued)

Guide to Computer Forensics and Investigations, 2e 43

Understanding RAID (continued)Understanding RAID (continued)

Guide to Computer Forensics and Investigations, 2e 44

Understanding RAID (continued)Understanding RAID (continued)

• RAID 3– Uses data stripping and dedicated parity

• RAID 4– Data is written in blocks

• RAID 5– Places parity recovery data on each disk

• RAID 6– Redundant parity on each disk

Guide to Computer Forensics and Investigations, 2e 45

Understanding RAID (continued)Understanding RAID (continued)

Guide to Computer Forensics and Investigations, 2e 46

SummarySummary

• Macintosh uses HFS– Hierarchical structure

• Mac OS file structure– Data fork and resource fork

• Volume refers to any storage media– Allocation and logical blocks

• Ext2fs uses inodes– Ext3fs: journaling version of Ext2fs

Guide to Computer Forensics and Investigations, 2e 47

Summary (continued)Summary (continued)

• Linux file structure– Meta-data and data

• CDs and DVDs are optical media– ISO 9660 and 13346

• Other device technologies– SCSI– IDE/EIDE– RAID