Linux and Macintosh File Systems

/etc/exports

File systems exported to remote hosts; might include remote drive mappings.

/etc/fstab

File system table of devices and mount points.

/var/log/wtmp

Logon and logoff history information.

/var/run/utmp

Current user’s logon information.

/var/log/dmesg

System messages log.

/var/log/syslog

System log, occasionally called system.log or kernel.log.

/etc/shadow

Master password file, containing hashed passwords for the local system.

/etc/group

Group memberships for the local system.

/etc/passwd

Account information for the local system

Boot block

It contains the bootstrap code.

Superblock

Contains vital information about the system and is considered part of the metadata.

Inode blocks

Contain the first data after the superblock.

Data Block

This is where directories and files are stored on a disk drive.

Inodes

Contain file and directory metadata and provide a mechanism for linking data stored in data blocks.

Bad block inode

The bad sectors in an inode that Linux can only track.

Hard Link

A pointer that allows accessing the same file by different filenames.

Link Count

A field inside each inode that specifies the number of hard links.

Symbolic links

Simply pointers to other files and aren’t included in the link count.

Hierarchical File System (HFS)

Before OS X, the ______ was used, in which files are stored in directories (folders) that can be nested in other directories. It is s limited to 65,536 blocks per volume.

Extended Format File System (HFS+)

With Mac OS 8.1, Apple introduced the _______. It has raised the number of blocks to more than 4 billion.

Apple File System (APFS)

In macOS High Sierra, the _____ was introduced. It differs from many file systems in that when data is written to a device, the metadata is also copied to help with crash protection.

Data fork

This is where data is stored.

Resource fork

This is where file metadata and application information are stored.

Volume

Any storage medium used to store files.

Logical Block

A collection of data that can’t exceed 512 bytes.

Allocation Block

this is where files you save are assigned; it’s a group of consecutive logical blocks.

Logical EOF

The actual ending of a file’s data.

Physical EOF

The number of bytes allotted on the volume for a file.

Clumps

Are groups of contiguous allocation blocks.

Master Directory Blck (MDB)

This is where all information about a volume is stored and written to it when the volume is initialized.

Volume Control Block (VCB)

When the OS mounts a volume, some information from the MDB is written to a _________, stored in system memory.

Extents Overflow File

It is used to store any file to in the MDB or VCB.

Catalog

The listing of all files and directories on the volume and is used to maintain relationships between files and directories on a volume.

Volume Bitmap

A system application that tracks each block on a volume to determine which blocks are in use and which ones are available to receive data.

B\*-tree file system

It is used to organize the directory hierarchy and file block mapping.

Header Mode

It stores information about the B\*-tree file.

Index Mode

It stores link information to previous and next nodes.

Map Node

It stores a ode descriptor and a map recorder.

Plist files

Are preference files for installed applications on a system, usually stored in /Library/Preferences.

FileVault

Used to encrypt and decrypt a user’s /users directory. It has master keys and recovery keys, which research later proved could be retrieved from RAM and used to crack encryption.

KeyChains

Used to manage passwords for applications, websites and other system files.