Cos psa 413
This presentation is the property of its rightful owner.
Sponsored Links
1 / 63

COS/PSA 413 PowerPoint PPT Presentation


  • 129 Views
  • Uploaded on
  • Presentation posted in: General

COS/PSA 413. Day 4. Agenda. Questions? Assignment 1 Corrected 3 A’s, 2 B’s, 2 C’s, 2 D’s and 1 F’s Assignment 2 posted Due in one week Lab Write-ups (project 2-1 and 2-2) due Lab tomorrow at OMS Project 2-5, Project 3-3, Project 3-4 (with modifications), Project 3-6

Download Presentation

COS/PSA 413

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Presentation Transcript


Cos psa 413

COS/PSA 413

Day 4


Agenda

Agenda

  • Questions?

  • Assignment 1 Corrected

    • 3 A’s, 2 B’s, 2 C’s, 2 D’s and 1 F’s

  • Assignment 2 posted Due in one week

  • Lab Write-ups (project 2-1 and 2-2) due

  • Lab tomorrow at OMS

    • Project 2-5, Project 3-3, Project 3-4 (with modifications), Project 3-6

  • Begin Discussion on Macintosh and Linux Boot Process and Disk Structures

    • Chapter 4 in 1e and Chapter 8 in 2e


Assignment 1 analysis

Assignment 1 Analysis

  • Excessive Plagiarism

    • I do not accept “cut and paste” work from the web

    • Please review UMFK’s Academic Integrity Policy

    • Just changing the wording of something doesn’t mean you wrote it (http://www.mcctf.org/)

    • Further Infractions will receive formal charges of cheating filed with student conduct officer, Grades of Zero and possible dismissal from this class.


Assignment 1 answers

Assignment 1 Answers

  • Assignment 1 answers

    • The are 3 Laws all from Chapter 18 of Title 17-A of the Maine Criminal Code

      • 432 Criminal Invasion of computer privacy (Class D) enacted 1989

      • 433 Aggravated criminal invasion of computer privacy (Class C) enacted 1989

      • 239 Solicitation of child by Computer to commit a prohibited Act (Class C) enacted in 2003 (2001)

  • Cases

    • There are about 12 that I know of. What I was looking for cases prosecuted under the laws you listed and properly cited.

    • Many listed cases that nothing to do with the laws they found

  • What are there not more cases, especially for 432 & 433 which have been around for 16 years?


Macintosh and linux boot process and disk structures

Macintosh and Linux Boot Process and Disk Structures

Chapter 4


Cos psa 413

Learning Objectives

  • Understand Macintosh Disk Structures

  • Explore Macintosh Boot Tasks

  • Examine UNIX and Linux Disk Structures

  • Understand UNIX and Linux Boot Processes

  • Examine Compact Disk (CD) Data Structures

  • Understand Other Disk Structures


Understanding the macintosh file structure

Understanding the Macintosh File Structure

  • Mac OS X version 10.3

    • Darwin core

    • BSD UNIX application layer

  • Hierarchical File System (HFC)

    • Extended Format (HFC+)

  • File Manager and Finder

  • Data fork and resource fork


Cos psa 413

Understand Macintosh File Structure (v ( and below)

Hierarchical File System – The system used by the MAC OS to store files, consisting of folders and subfolders, which can be nested.


Cos psa 413

Understand Macintosh File Structure

File Manager – In Macintosh file system, it handles the reading, writing, and storage of data to physical media. It also collects data to maintain the HFS along with manipulation of files, folders, and volumes.


Cos psa 413

Understand Macintosh File Structure

Finder – Works with the Macintosh OS to keep track of files and maintain the user’s desktop.


Cos psa 413

Understand Macintosh File Structure

Data Fork – The part of the Macintosh file structure that contains the actual data of a file.

Resource Fork – The part of the Macintosh file system that contains the resource map, header information for the file, window locations, and icons.


Cos psa 413

Understand Macintosh File Structure


Cos psa 413

Understand Macintosh File Structure

  • The resource fork contains the following information:

  • Resource map

  • Resource header information for each file

  • Window locations

  • Icons


Cos psa 413

Understand Macintosh File Structure

Volume – Refers to any storage media in the Macintosh file system. A volume can be a single floppy disk, a partition on a hard drive, the entire drive, or several drives.


Understanding volumes

Understanding Volumes

  • Storage medium used to store files

  • A volume can be all or part of a hard disk

    • On a floppy disk, is always the entire disk

  • Multiple clients per volume

  • Allocation and logical blocks

    • Logical blocks cannot exceed 512 bytes

    • Allocation blocks are a set of logical blocks


Cos psa 413

Understand Macintosh File Structure


Cos psa 413

Understand Macintosh File Structure

Allocation Blocks – The number of logical blocks assembled in the Macintosh file system when a file is saved.

Logical Blocks – In the Macintosh file system, a collection of data that cannot exceed 512 bytes. These are assembled in allocation blocks to store files.


Cos psa 413

Understand Macintosh File Structure


Cos psa 413

Understand Macintosh File Structure

Logical EOF – In the Macintosh file system, the number of bytes that contain data.

Physical EOF – In the Macintosh file system, the number of allocation blocks assigned to the file.

Difference between the two is free space


Cos psa 413

Understand Macintosh File Structure


Cos psa 413

Understand Macintosh File Structure

Clumps – In the Macintosh file system, a contiguous allocation block. Clumps are used to keep file fragmentation to a minimum.


Cos psa 413

Explore Macintosh Boot Tasks

Master Directory Block (MDB) – On older Macintosh systems, the location where all information about a volume is stored. A copy of the MDB is kept in the next to the last block on the volume.

Volume Information Block (VIB) – Another name for the Master Directory Block.


Cos psa 413

Explore Macintosh Boot Tasks

Extents Overflow File – Used by the Macintosh File Manager when the list of contiguous blocks of a file becomes too long. The overflow of the list is placed in the extents overflow file. Any file extents not in the MDB or VCB are contained here.


Cos psa 413

Explore Macintosh Boot Tasks

Volume Control Block (VCB) – Contains information from the MDB and is used by the File Manager in the Macintosh file system.

Catalog –Is used to maintain the relationships between files and directories on a volume.

Volume Bitmap – Tracks each block on a volume.

B*-Tree –Organizes the directory hierarchy and file block mapping for the File Manager.

Header Node – Stores information about the B*-Tree file.


Exploring macintosh boot tasks

Exploring Macintosh Boot Tasks

  • Use Open Firmware

    • Processor- and system-independent firmware

  • Older Macintosh OSs

    • First two logical blocks are boot blocks

    • Master Directory Block (MDB) or Volume Information Block (VIB)

    • Extents overflow file

    • Volume Control Block (VCB)


Exploring macintosh boot tasks continued

Exploring Macintosh Boot Tasks (continued)

  • Volume Bitmap

    • Tracks used and unused blocks on a volume

  • Mac OS 9 uses a B*-tree file system for File Manager

    • Actual file data is stored on the leaf nodes

    • Header, index, and map nodes


Using macintosh forensic software

Using Macintosh Forensic Software

  • For Mac OSs earlier that Mac OS x

    • Expert Witness originally from ASRData, now owned by Guidance Software

    • Black Bag Technologies tools

      • Deal specifically with files Macintosh hides

      • PhantomSearch

  • For Mac OS X

    • Almost any UNIX/Linux forensic tool


Examining unix and linux disk structures

Examining UNIX and Linux Disk Structures

  • UNIX flavors

    • System 7, SGI IRIX, Sun Solaris, IBM AIX, and HP-UX

    • BSD, FreeBSD, OpenBSD, and NetBSD

  • Linux distributions

    • Caldera, Red Hat, SuSe, Mandrake, and Debian

    • Most consistent UNIX-like OSs

  • GNU and BSD licenses


Examining unix and linux disk structures continued

Examining UNIX and Linux Disk Structures (continued)


Examining unix and linux disk structures continued1

Examining UNIX and Linux Disk Structures (continued)


Examining unix and linux disk structures continued2

Examining UNIX and Linux Disk Structures (continued)

  • Linux file systems

    • Second Extended File System (Ext2fs)

    • Ext3fs, journaling version of Ext2fs

  • Employs inodes

    • Pointer to other inodes or blocks

    • Keep internal link count

      • Deleted inodes have count value 0

  • Linux file structure

    • Meta-data and data


Examining unix and linux disk structures continued3

Examining UNIX and Linux Disk Structures (continued)


Unix and linux overview

UNIX and Linux Overview

  • Everything is a file

    • Files are defined as objects

  • UNIX consists of four components

  • Boot block

    • Disk allocation unit of at least 512 bytes

    • Contains the bootstrap code

    • Only one


Unix and linux overview continued

UNIX and Linux Overview (continued)

  • Superblock

    • Indicates disk geometry, available space, and location of the first inode

    • Manages the file system

  • Inode blocks

    • First data after the superblock

    • Assigned to every file allocation unit

  • Data blocks

    • Where directories and files are stored


Unix and linux overview continued1

UNIX and Linux Overview (continued)


Unix and linux overview continued2

UNIX and Linux Overview (continued)

  • Bad block inode

    • Keeps track of disk bad sectors

    • Commands: badblocks, mke2fs, and E2fsck/

  • Linux ls command displays information about files

  • Continuation inode provides more information about a file or directory


Unix and linux overview continued3

UNIX and Linux Overview (continued)


Unix and linux overview continued4

UNIX and Linux Overview (continued)


Understanding inodes

Understanding Inodes

  • Link data stored in data blocks

  • Ext2fs and Ext3fs are improvements over Ext

    • Data recovery easier on Ext3fs than on Ext2fs

  • First inode has 13 pointers

    • Pointers 1 to 10 are direct pointers

    • Pointer 11 is an indirect pointer

    • Pointer 12 is a double-indirect pointer

    • Pointer 13 is a triple-indirect pointer


Understanding inodes continued

Understanding Inodes (continued)


Understanding inodes continued1

Understanding Inodes (continued)


Understanding unix and linux boot processes

Understanding UNIX and Linux Boot Processes

  • Instruction code in firmware is loaded into RAM

  • Instruction code then

    • Checks the hardware

    • Load the boot program

  • Boot program

    • Loads kernel

    • Transfers control to kernel


Understanding unix and linux boot processes continued

Understanding UNIX and Linux Boot Processes (continued)

  • Kernel

    • Boots system on single-user mode

    • Runs startup scripts

    • Changes to multiuser mode

    • Identifies root directory, swap and dump files

    • Sets host name, time zone

    • Runs consistency checks on the file system and mounts partitions

    • Starts services


Understanding linux loader and grub

Understanding Linux Loader and GRUB

  • Linux Loader (LILO)

    • Old boot manager

    • Can start two or more OSs

    • Uses configuration file lilo.conf

  • Grand Unified Boot Loader (GRUB)

    • More powerful than LILO

    • As LILO resides on MBR

    • Command line or menu driven


Unix and linux drives and partition schemes

UNIX and Linux Drives and Partition Schemes

  • Labeled as path starting at root (/) directory

    • Primary master disk

      • First partition is /dev/hda

      • Second partition is /dev/hda2

    • Primary slave or secondary master or slave

      • First partition is /dev/hdb

    • SCSI controllers

      • /dev/sda with first partition /dev/sda1


Examining cd data structures

Examining CD Data Structures

  • Laser burns flat areas (lands)

  • Lower areas are called pits

  • Transitions

    • From lands to pits have binary value 1, or on

    • No transition has binary value 0, or off

  • ISO standards

    • ISO 9660 for CD, CD-R, and CD-RW

    • ISO 13346 for DVDs


Examining cd data structures continued

Examining CD Data Structures (continued)


Examining cd data structures continued1

Examining CD Data Structures (continued)


Examining cd data structures continued2

Examining CD Data Structures (continued)

  • Frame is the unit storage

    • Contains 24 17-bit symbols

  • Frames are combined into blocks

  • Blocks are combined into sectors

    • 2352 bytes for CD-DA

    • 2048 bytes for CD

  • Constant Linear Velocity (< 12X)

  • Constant Angular Velocity (>= 12X)


Understanding other disk structures

Understanding Other Disk Structures

  • SCSI disks

  • IDE/EIDE disks

  • RAID configurations


Examining scsi disks

Examining SCSI Disks

  • SCSI

    • Provides a common bus communication device

  • During investigation

    • Check if the device is internal or external

    • Check if card, cables, adapters, terminators, and drivers are available

    • Advance SCSI Programming Interface (ASPI)

  • Might need to adjust settings

    • Port numbers and terminators


Examining ide eide devices

Examining IDE/EIDE Devices

  • ATA drives from ATA-33 to ATA-133

    • Standard 40-pin ribbon or shielded cable

    • 40-pin/80-wire cable for ATA-66, 100, and 133

  • CMOS identifies proper disk settings

    • Logical block addressing (LBA)

    • Enhanced CHS configurations

    • Can pose a problem during an investigation


Examining ide eide devices1

Examining IDE/EIDE Devices

  • Solutions

    • Disk imaging tools

    • Old PC

    • Cards and adapters

      • ISA SCSI card

      • A-Card IDE adapter

      • SCSI-to-IDE adapter

      • EISA FireWire card

      • FireWire-to-EIDE adapter


Examining the ide host protected area

Examining the IDE Host Protected Area

  • ATAPI-5 AT introduced in 1998 reserved and protected areas on IDE devices

    • Protected Area Run Time Interface Extension Service (PARTIES)

  • Contains data stored by diagnostic and restore programs

  • Tools

    • Area 51

    • BIOS, XBIOS Direct Access Reporter (BXDR)


Understanding raid

Understanding RAID

  • RAID 0

    • Provides rapid access and increased storage

    • Lack of redundancy

  • RAID 1

    • Designed for data recovery

    • More expensive than RAID 0

  • RAID 2

    • Data is written to a disk on a bit level

    • Slower than RAID 0


Understanding raid continued

Understanding RAID (continued)


Understanding raid continued1

Understanding RAID (continued)


Understanding raid continued2

Understanding RAID (continued)


Understanding raid continued3

Understanding RAID (continued)

  • RAID 3

    • Uses data stripping and dedicated parity

  • RAID 4

    • Data is written in blocks

  • RAID 5

    • Places parity recovery data on each disk

  • RAID 6

    • Redundant parity on each disk


Understanding raid continued4

Understanding RAID (continued)


Cos psa 413

Chapter Summary

  • The Macintosh uses a hierarchical file system where files are stored in folders, which can be nested in other folders. The File Manager handles the reading, writing, and storage of data to physical media.

  • In the Mac OS, a file consists of two parts: a data fork and a resource fork. The resource fork contains a resource map and resource header information for each file, window locations, and icons. The data fork typically contains data that the user creates, such as text or spreadsheets.


Cos psa 413

Chapter Summary

  • A volume is any storage media that is used to store files.

  • Volumes have allocation blocks and logical blocks. A logical block is a collection of data that cannot exceed 512 bytes. An allocation block is a group of consecutive logical blocks.

  • For older Macintosh operating systems, the first two logical blocks on each volume are the boot blocks, which contain information about the system startup. The startup block contains information about the system configuration.


Cos psa 413

Chapter Summary

  • The Linux second extended file system uses inodes. When the internal link count reaches “0”, a file is considered to be deleted.

  • The Linux file structure is made up of meta-data and data. Meta-data includes items such as the user ID and group ID. An inode contains the modification/access/creation time, not a filename.

  • Compact discs and digital video discs are optical media used to store large amounts of data. They are regulated by the ISO 9660 and ISO 13346.

  • SCSI connectors are used for a variety of peripheral devices.


  • Login