Title: 2. Exploring Macintosh Boot Tasks
Course: IN 2005 Digital Forensics > Section: Module 8: Chapter 8 - Macintosh and Linux Boot Processes and File Systems

Exploring Macintosh Boot Tasks

1. The use of Open Firmware as opposed to BIOS firmware commonly found on PC-based systems.
2. The boot process for OS 9 is as follows:
  - Power on the computer
  - Hardware self-test and Open Firmware run
  - Macintosh OS starts
  - The startup disk is located
  - System files are opened
  - System extensions are loaded
  - OS 9 Finder starts
3. See Tables 8-1 and 8-2 to show an overview of how HFS and HFS+ system files handle data.
4. The following terms and their functions on a Mac OS:
  - Boot blocks
  - Master Directory Block (MDB) or Volume Information Block (VIB)
  - Extent overflow file
  - Volume Control Block
  - Catalog
  - Volume Bitmap
  - B*-tree

Using Macintosh Forensic Software

1. This section describes the following tools and vendors:
  - BlackBag Technologies
  - SubRosaSoft MacForensicsLab
  - Guidance EnCase
  - X-Ways Forensics
  - ProDiscover Forensic Edition
  - Sleuth Kit and Autopsy
2. To examine a Macintosh computer, you need to make an image of the drive. A static acquisition of the suspect drive is preferable to a live acquisition.  Removing the drive from a Macintosh Mini’s CPU case is difficult, and attempting to do so without Apple factory training could damage the computer.
3. You need a Macintosh-compatible forensic boot CD to make an image.
4. BlackBag Technologies sells acquisition products specifically designed for OS 9 and earlier as well as OS X.  For example, MacQuisition is a forensic boot CD that makes an image of a Macintosh drive.
5. After making an acquisition, the next step is to examine the image of the file system.  The tool you use depends on the format of the image file.
6. BlackBag Technologies Macintosh Forensic Software and SubRosaSoft MacForensicsLab have a feature for disabling and enabling Disk Arbitration.
7. Being able to turn off the mount function in OS X allows you to connect a suspect drive to a Macintosh without a write-blocking device.
8. See Table 8-3 and Figures 8-4 through 8-9 to describe how to examine OS 9 Data Structures with BlackBag.