Title: 3. Examining UNIX and Linux Disk Structures and Boot Processes
Course: IN 2005 Digital Forensics > Section: Module 8: Chapter 8 - Macintosh and Linux Boot Processes and File Systems

Examining UNIX and Linux Disk Structures and Boot Processes

1. View several UNIX types and Linux distributions. See Table 8-4.
2. Some useful Linux commands to find information about your Linux system, including:
  - uname –a
  - ls –l
  - ls –ul filename
  - netstat -s
3. The Linux file system Ext2fs and its journaling version Ext3fs.  Highlight the use of inodes, metadata and data as part of the files structure.

UNIX and Linux Overview

1. Everything is a file on UNIX and Linux. Files are defined as objects, which means they have properties and methods.
2. See Figure 8-10 to view a detailed explanation of the following four components on an UNIX system:
  - Boot block
  - Superblock
  - Inode blocks
  - Data blocks
3. Bad sectors and how they can be used on UNIX and Linux to hide information.
4. The use of the ls command to get information about a file. See Figure 8-11.
5. The role of a continuation inode. See Table 8-5.

Understanding Inodes

1. The main purpose of inodes is to link data stored on data blocks. Linux offers Ext2fs and Ext3fs as improvements to the original Ext file system.
2. UNIX/Linux file systems use inodes that implement direct, indirect, double-indirect, and triple-indirect pointers. See Figure 8-12 that illustrate the use of these pointers when handling large size files.

Understanding UNIX and Linux Boot Processes

1. The instruction code in firmware is loaded into RAM. The instruction code then checks the hardware and loads the boot program.
2. The boot program loads the kernel and transfers control to the kernel.
3. The kernel’s first task is to identify all devices.
4. The kernel additionally:
  - Boots the system in single-user mode, then runs startup scripts and enables multiuser mode
  - Identifies root directory, swap and dump files
  - Sets host name, time zone
  - Runs consistency checks on the file system and mounts partitions
  - Starts network daemons, sets up the NIC, and establishes user and system accounting and quotas

Understanding UNIX and Linux Drives and Partition Schemes

1. UNIX and Linux name drives and partitions depending on what controller the device is connected to. Examples include:
  - /dev/hda
  - /dev/hdb
  - /dev/sda

Examining UNIX and Linux Disk Structures

1. Most commercial computer forensics tools can analyze UNIX UFS and UFS2 and Linux Ext2, Ext3, ReiserFS and Reiser4 file systems. Freeware tools include Sleuth Kit and its Web browser interface, Autopsy Browser.
2. Foremost is a freeware carving tool that can read many image file formats.  It has a configuration file called foremost.conf.
3. A tarball is a data file containing one or more files or whole directories and their contents.
4. See Figures 8-13 and 8-14 to explain how to install Sleuth Kit and Autopsy.
5. See Figures 8-15 through 8-18 to view how to use Sleuth Kit and Autopsy Browser to analyze a Linux Ext2 and Ext3 file system.
6. See Figures 8-19 and 8-20 that showa how to use the File Activity Time Lines function, which is useful for identifying what files were active at a specific time.