Title: 1. Understanding the Macintosh File Structure and Boot Process
Course: IN 2005 Digital Forensics > Section: Module 8: Chapter 8 - Macintosh and Linux Boot Processes and File Systems

Understanding the Macintosh File Structure and Boot Process

1. The File Manager utility handles reading, writing, and storing data to physical media.  The Finder tool works with the OS to keep track of files and maintain users’ desktops.
2. In older Mac OSs, a file consists of two parts: the data fork and resource fork, where file metadata and application information are stored. See Figure 8-1.

Understanding Macintosh OS 9 Volumes

1. A volume is any storage medium used to store files.  A volume can be all or part of a hard disk. On a floppy disk is always the entire disk.
2. See Figure 8-2 to show the relationship between allocation and logical blocks. Logical blocks cannot exceed 512 bytes. Allocation blocks are a set of consecutive logical blocks.
3. Two types of end of file (EOF) descriptors:
  - Logical EOF
  - Physical EOF
4. Clumps as groups of contiguous allocation blocks. Clumps are used to reduce fragmentation.