Presentation on theme: "Chapter 3: Windows, Linux, and Macintosh Boot Processes"— Presentation transcript:
1 Chapter 3: Windows, Linux, and Macintosh Boot Processes Forensics Book 2: Investigating Hard Disk and File and Operating SystemsChapter 3: Windows, Linux, and Macintosh Boot Processes
2 Objectives Understand boot loaders Understand boot sectors Describe the basic system boot processExplain the MS-DOS boot processExplain the Windows XP boot process
3 Objectives (continued) Explain the Linux boot processExplain the Mac OS X boot process
4 Introduction to Windows, Linux, and Macintosh Boot Processes This chapter:Focuses on the boot processes for the major operating systems available todayBooting, also called bootstrappingProcess of loading an operating system into a computer’s main memoryThis step takes place during the boot sequenceSet of steps a computer system takes after it has been powered on
5 Boot Loader Boot loader or boot manager Program that loads the operating system into a computer’s memory when the system is bootedMultiple-stage boot loaders are commonA number of small programs call each other, and the last program loads the operating system
6 Boot Sector Boot sector Memory sector of a hard disk, floppy disk, or similar data storage device that contains code for bootstrapping systemsAlways the first sector on the first trackEach valid boot sector has two bytes (0x55AA), called a boot sector signature, at the end of the sector
7 Boot Sector (continued) Figure 3-1 This shows a boot sector, including the boot sector signature.
8 Boot Sector (continued) Two major kinds of boot sectors:Volume boot recordMaster boot recordA master boot record contains the following structures:Master partition tableMaster boot codeBIOSProgram a personal computer’s microprocessor uses to get the computer system started after a user turns it on
9 Boot Sector (continued) Figure 3-2 This shows the code for a master boot record.
10 Boot Sector (continued) Figure 3-3 This shows the structure of a master boot record.
11 Basic System Boot Process Steps:The system clock generates a series of clock ticks, which initializes the CPUThe CPU looks to the system’s startup program in the ROM BIOS for its first instructionThe first instruction is to run the power-on self-test (POST), in a predetermined memory addressPOST checks the BIOS chip and then tests CMOS RAMCMOS (complementary metal-oxide semiconductor) memory holds the system date, time, and setup parameters
12 Basic System Boot Process (continued) Steps: (continued)If there is no battery failure, POST checks the inventoried hardware devices to check whether they are functioning properlyCPU initialization is completed if everything is fineThe BIOS looks into the CMOS chip to find the drive where the OS is installedThe BIOS then checks the boot record of the drive to find the beginning of the OS and the subsequent program file that initializes the OSThe BIOS copies its files into memory after OS initialization
13 Basic System Boot Process (continued) Steps: (continued)The OS takes over control of the boot processThe OS performs another inventory of the system’s memory and memory availability and loads the device drivers that it needs to control the peripheral devices
14 MS-DOS Boot Process Steps: The BIOS initiates power-on self-test (POST)POST performs the following actions:Initializes the keyboard and other system hardware, such as the video cardTests the computer’s RAMChecks the disk drivesAttempts to find a valid operating systemThe BIOS searches for the file IO.SYS in the root directory and loads it into RAMIO.SYS provides services for peripherals such as printers, modems, and disk drives
15 MS-DOS Boot Process (continued) Steps: (continued)IO.SYS loads a file called MSDOS.SYS, which is an extension of ROM or the BIOSMSDOS.SYS acts as a gateway for communication between DOS and the BIOSMSDOS.SYS loads the CONFIG.SYS fileCONFIG.SYS stores system configurationsCONFIG.SYS is processed and executedMSDOS.SYS loads the COMMAND.COM program file into memoryCOMMAND.COM loads an optional file called AUTOEXEC.BAT and executes it
16 Windows XP Boot Process Steps:The power supply performs a self-test and sends the power good signal to the processorThe timer chip stops sending reset signals to the processor, allowing the CPU to begin operationsThe CPU loads the ROM BIOS starting at ROM memory address FFFF:0000The ROM BIOS contains a JMP (jump) instruction that points to the actual address of the ROM BIOS codeThe ROM BIOS performs a basic test of central hardware to verify basic functionality
17 Windows XP Boot Process (continued) Steps: (continued)The BIOS searches for adapters that may need to load their own ROM BIOS routinesStartup BIOS routines scan memory addresses C000:0000 through C780:0000 to find video ROMThe ROM BIOS checks to see if this is a cold boot (the startup of a system from a powered-down state) or a warm boot (the restart of a system that is already on)If this is a cold boot, the ROM BIOS executes a full POST (power-on self-test)If this is a warm boot, the memory test portion of the POST is switched off
18 Windows XP Boot Process (continued) Steps: (continued)POST can be broken down into two components:A video test initializes the video adapterA video adapter tests the video card and video memory and displays configuration information or any errorsThe BIOS locates and reads the configuration information stored in CMOSThe BIOS examines the disk for a master boot record (MBR)With a valid MBR loaded into memory, the BIOS transfers control of the boot process to the partition loader code
19 Windows XP Boot Process (continued) Steps: (continued)The partition loader, or boot loader, examines the partition table for a partition marked as activeThe partition loader then searches the very first sector of that partition for a boot record.The active partition’s boot record is checked for a valid boot signature and, if found, the boot sector code is executed as a program
20 Windows XP Boot Process (continued) Steps: (continued)NTLDR, a hidden system file in the root directory of the system partition, controls loading of Windows XP in four stages:Initial boot loader phaseOperating system selectionHardware detectionConfiguration selectionNTOSKRNL goes through two phases in its boot processI/O Manager starts loading all the system driver filesWin32k.sys switches the screen into graphics mode
21 Windows XP Boot Process (continued) Steps: (continued)The services subsystem starts all services marked as Auto StartOnce all devices and services are started, the boot is deemed successful, and this configuration is saved as the last known good configurationThe WINLOGON.EXE file starts the logon processThis is a login manager file that is responsible for all login and logout proceduresThe Local Security Authority (LSASS.EXE) process displays the logon dialog box
22 FTK Imager (continued) Figure 3-5 This is the logon dialog box for Windows XP Professional.
23 Linux Boot Process The Linux boot process comprises five major steps: Step 1, boot manager: responsible for starting the booting processStep 2, init: initializes booting.Step 2.1, /etc/inittab: contains lines with four fields: id, run level, action, and processStep 3, services: initiates the services that run at startupStep 4, more inittab: starts all processes configured as “respawn” processes
24 Step 1: Boot ManagerWhen a Linux computer is booted, the processor first checks system memory for the BIOS and runs itThe BIOS tests the system, looks for and checks peripherals, and then looks for a bootable device to boot the systemThe order of the drives used for booting is usually controlled by a particular BIOS setting on the systemThe BIOS looks for a master boot record (MBR) starting at the first sector on the first hard drive, loads its contents into memory, and then passes control to it
25 Step 1: Boot Manager (continued) The MBR contains instructions on how to load the LILO (Linux Loader) or GRUB boot loader, using a pre-selected operating systemThe MBR then loads the boot loader, which takes over the processThe boot loader finds the necessary boot file and hands off control of the machine to that operating system
26 Step 2: initThe kernel, once it is loaded, finds init in sbin and executes itKernel is the principal part of an operating system that loads first and is stored in physical memory (RAM)When init starts, it becomes the parent of all of the processes that start up automatically on LinuxThe first thing init does is read its initialization file, /etc/inittabInstructs init to read an initial configuration script for the environmentDescribes how the system should be set up in each run level, and sets the default run level
27 Step 2: init (continued) After having determined the default run level for the system, init starts all of the background processes necessary for the system to runBy looking in the appropriate rc directory for that run level
28 Step 2.1: /etc/inittabEach entry in the inittab file has four fields separated by a colonIdentifierRun levelActionboot, bootwait, ctrlaltdel, initdefault, kbrequest, off, once, ondemand, powerfail, powerokwait, powerwait, respawn, syswait, waitCommandchitab, lsitab, mkitab, rmitab
29 Step 2.1: /etc/inittab (continued) Run levelsDefine what services or processes should be running on the systemThe main run levels are numbered from 0 to 6Run level 0: Halt systemRun level 1: Single-user modeRun level 2: Basic multi-user mode without NFSRun level 3: Full multi-user mode (text based)Run level 4: UnusedRun level 5: Multi-user mode with graphical user interfaceRun level 6: Reboot system
30 Step 2.1: /etc/inittab (continued) Run levels 1 and 2 are generally used for debugging purposesMost servers boot into run level 3Linux run levels can be changed using the telinit commandEach run level is maintained in its own directory structureThese directories are located in the /etc/rc.d/ directoryIt is also possible to change the run level during booting
31 Step 3: ServicesThe Linux services are specified in the directory /etc/init.d or /etc/rc.d/init.dThe directory /etc/rc.d/init.d contains the start and stop scripts
32 Mount Image Pro (continued) Figure 3-6 Users can change various options for system services using the Service Configuration utility.
33 Step 4: More inittab The init program Retrieves all lines in /etc/inittab with the action set to “respawn” for the current run levelStarts those processesRespawn commands are restarted when they end, so they will run continuously as long as the system is in run level 5Finally, the system is booted and ready to accept login requests
34 Mac OS X Mac OS X is based on the BSD Darwin engine The Mac OS X startup process is nothing like other UNIX systemsMac OS X finds its startup items in either /System/Library/StartupItems or /Library/StartupItemsTo set an application to start at system startupCreate a subdirectory under /Library/StartupItemsPut a startup file in that subdirectoryAdd a StartupParameters.plist file to that subdirectoryIf needed, set the control variable to determine whether the daemon starts at boot
35 Mac OS X Hidden Files and Key Directories In UNIX, files can be hidden or made invisible by prefixing the file name with a period (.)Mac OS X uses a file in the root directory (.hidden) to maintain a list of files that should be hidden from the FinderMac OS X uses a file system called HFS+Files and directories can have a hidden attribute set using the SetFile command
36 Mac OS X Boot ProcessThe boot process in Mac OS X depends on three important parts:Mac’s Open FirmwareBoot loaderTypical Mac OS X boot sequenceFirmwareSoftware programs or instructions stored in the read-only memory (ROM) of a hardware deviceProvides the necessary instructions during the boot process for the computer to find the installed operating system and continue to boot up
37 Open FirmwareNon-proprietary, platform-independent boot firmware that is similar to a PC’s BIOSStored in ROMFirst stored program executed upon power-upA user can start Open Firmware by pressing the key combination Command-Option-O-F just as the user powers up the computerIt is more convenient to access a Mac’s Open Firmware from another computer over the networkThe user can run a telnet server on the system
38 Boot LoaderBootX can load kernels from various file systems such as HFS+, HFS, UFS, ext2, and TFTPBootX can also load ELF kernelsBootX (/System/Library/CoreServices/BootX) is the default boot loader for Mac OS XSequence of events when BootX starts executing:BootX first initializes the Open Firmware client interface and retrieves the firmware versionIt then creates a pseudo-device called sl_words in the firmware, and defines various FORTH words in itBootX looks up the options device in the firmware, which contains various variables
39 Boot Loader (continued) Sequence of events when BootX starts executing: (continued)BootX looks up the chosen device, which contains handles for entities such as the boot input/output devices, the memory, the MMU, the PMU, the CPU, and the PICBootX initializes handles to the MMU and memory using the chosen deviceBootX initializes handles to the boot display and the keyboard (if present)BootX checks if the security mode is “none,” or checks if the “verbose” or “single user” flags were specified, and sets the output level accordingly
40 Boot Loader (continued) Sequence of events when BootX starts executing: (continued)BootX checks if the system is booting in Safe ModeBootX claims memory for various purposesBootX finds all displays and sets them upWhile opening the display(s), BootX also sets the screen color to the familiar whitish grayBootX looks up the boot device, boot arguments, and other components, and determines where to get the kernel fromAt this point, BootX draws the Apple logo splash screen and starts the spinning cursor
41 Boot Loader (continued) Sequence of events when BootX starts executing: (continued)Depending on various conditions, BootX tries to retrieve and load the kernel cache file.The next step is to “decode” the kernelBootX attempts to decode the file as a Mach-O binaryIf the above fails, BootX gives up, draws the failed boot picture, and goes into an infinite loopIf BootX is successful so far, it saves file system cache hits, misses, and evicts; sets up various boot arguments and values; and also calls a recursive function to flatten the device treeFinally, BootX calls the kernel
42 Mac OS X Boot Options Mac OS X boot options: C, D, N, R, T Mouse button held downShiftOptionSpace barCommand-VCommand-SCommand-OptionCommand-Option-P-RCommand-Option-N-V
43 Mac OS X Boot Options (continued) Command-Option-O-FCommand-Option-Shift-DeleteCommand-Option-Shift-Delete-#(where # = a SCSI device ID)Mac OS X boot options that work on older computers only:Command-Option-ICommandCommand-Option-T-VCommand-Option-X-OCommand-Option-A-V
44 Mac OS X Boot Sequence Steps: Open Firmware looks for hardware installed on the computer to initialize the boot driveOpen Firmware then loads a file of type tbxi (BootX) from the boot partition of the hard drive and executes itBootX reads the root partition out of NVRAMBootX copies Mac OS X device drivers from the boot partition into memory and disables all address translationsIt loads the kernelThe init routine of the kernel executes
45 Mac OS X Boot Sequence (continued) Steps: (continued)The kernel determines the root device of the booting systemThe kernel initializes Mach/BSD data structuresThe kernel initializes I/O KitThe kernel starts /sbin/mach_initThe following user-level steps take place:The mach_init process starts /sbin/initThe init process determines the run level and runs /etc/rc.bootSingle-user and CD-ROM boots do not run fsckThe /etc/rc process launches /sbin/SystemStarter
46 Installing Mac OS X on Windows XP Steps:Use the Darwin installation CD to partition the hard disk.Set prom_driver_graphic to “path/to/video.x”Set prom_env_bootargs to “” for Mac OS X 10.2Start PearPC, wait, and follow the instructions given by the installerClick the Customize button, and uncheck Additional Print Drivers, Additional Asian Fonts, and Localized FilesClick on the Install button and wait until installed
47 Installing Mac OS X on Windows XP (continued) Steps: (continued)Download BootCD onto a Mac running Mac OS X 10.2Use BootCD to create a .dmg file containing a stripped-down OS X systemConvert the .dmg that is created with BootCD into a .iso using the following command: hdiutil convert /path/to/bootableosx.dmg -format UDTO -o /path/to/output.isoCopy the output .iso to the destination machineEdit PearPC’s configuration file so that it uses the .iso file as an emulated CD-ROM driveStart PearPC with the configuration file
48 Tool: PearPCArchitecture-independent PowerPC emulator that can run most PowerPC operating systemsFeatures of PearPC:PearPC is based on C++, C, and (on x86 platforms) assembler code, and it’s supported host platforms are POSIX-X11 and Win32 .The following operating systems run in PearPC:Mandrake Linux 9.1 for PPC installerMandrake Linux 9.1 for PPC after installationDarwin for PPCMac OS X 10.3NetBSD for PPC
49 Tool: PearPC (continued) Limitations of PearPC:CPU emulation is slowPearPC will most probably run only on 32-bit architecturesA lot of unimplemented features are fatal and cause PearPC to abortPearPC lacks a save/restore machine-state featureIt does not support hard disks with storage capacities greater than 128 GB
50 Tool: PearPC (continued) Figure 3-7 Users can run a number of operating systems on PearPC, including Mac OS X, as shown here.
51 SummaryBooting is a process that starts operating systems when the user turns on a computer systemA boot loader is a small program that loads an operating system into a computer’s memory when the system is bootedA boot sector is a sector of a hard disk, floppy disk, or similar data storage device that contains code for bootstrapping systemsThe master boot record is the first sector of a data storage device that has been partitionedMac OS X is based on the BSD Darwin engine
Your consent to our cookies if you continue to use this website.