Linux and Macintosh File Systems

Examining Linux File Structures

Linux System Files

Core top-level directories of a Linux System

File Structures in Ext4

• UNIX/Linux has four components defining the file system:
  • Boot block: It contains the bootstrap code.
  • Superblock: Contains vital information about the system and is considered part of the metadata.
  • Inode blocks: Contain the first data after the superblock.
  • Inode: It is assigned to every file allocation unit.
  • Data Block: This is where directories and files are stored on a disk drive.

Inodes

• Inodes contain file and directory metadata and provide a mechanism for linking data stored in data blocks.
• When a file or directory is created on a Linux file system, an inode is assigned that contains the following information:
  • The mode and type of the file or directory.
  • The number of links to a file or directory
  • The UID and GID of the file’s or directory’s owner
  • The number of bytes in the file or directory
  • The file’s or directory’s last access time and last modified time
  • The inode’s last file status change time
  • The block address for the file data
  • The indirect, double-indirect, and triple-indirect block addresses for the file data
  • Current usage status of the inode
  • The number of actual blocks assigned to a file
  • File generation number and version number
  • The continuation inode’s link
• As a file grows, the OS provides up to three layers of additional inode pointers.
  • Indirect Pointers: The first 10 pointers in the inode.
  • Double-Indirect Pointers: The pointers in the second layer.
  • Triple-Indirect Pointers: The pointers in the last or third layer.
• Bad block inode: The bad sectors in an inode that Linux can only track.

Hard Links and Symbolic Links

• Hard Link: A pointer that allows accessing the same file by different filenames.
• Link Count: A field inside each inode that specifies the number of hard links.
• Symbolic links: Simply pointers to other files and aren’t included in the link count.
  • They can point to items on other drives or other parts of the network; they simply need an absolute path.

Understanding Macintosh File Structures

• Prior tems in that, when data is written to a device, the metadata is also copied for disaster protection.

An Overview of Mac File Structures

• In older versions of macOS, a file consists of two parts:
  • Data fork: This is where data is stored.
  • Resource fork: This is where file metadata and application information are stored.
• Volume: Any storage medium used to store files.
  • Logical Block: A collection of data that can’t exceed 512 bytes.
  • Allocation Block: this is where files you save are assigned; it’s a group of consecutive logical blocks.
• The HFS and HFS+ file systems have two descriptors for the end of a file (EOF).
  • Logical EOF: The actual ending of a file’s data.
  • Physical EOF: The number of bytes allotted on the volume for a file.
• In macOS, file fragmentation is reduced by using clumps.
  • Clumps: Are groups of contiguous allocation blocks.
• Master Directory Blck (MDB): This is where all information about a volume is stored and written to it when the volume is initialized.
• When the OS mounts a volume, some information from the MDB is written to a Volume Control Block (VCB), stored in system memory.
• Extents Overflow File: It is used to store any file to in the MDB or VCB.
• Catalog: The listing of all files and directories on the volume and is used to maintain relationships between files and directories on a volume.
• Volume Bitmap: A system application that tracks each block on a volume to determine which blocks are in use and which ones are available to receive data.
• File-mapping information is stored in two locations: the extents overflow file and the file’s catalog entry.
• B-tree file system: It is used to organize the directory hierarchy and file block mapping.
  • In this file system, files are nodes (records or objects) containing file data.
• The B-tree also has the following nodes that handle file information:
  • Header Mode: It stores information about the B*-tree file.
  • Index Mode: It stores link information to previous and next nodes.
  • Map Node: It stores a node descriptor and a map recorder.

Forensics Procedures in Mac

• Plist files: Are preference files for installed applications on a system, usually stored in /Library/Preferences.
• To view the SQLite database, use the SQLite Database Browser.
• Other files that might contain information useful for an investigation include the following:
  • /System/Library/CoreServices/SystemVersion.plist — It contains the OS version.
  • /Library/Preferences/SystemConfiguration/NetworkInterfaces — Shows all existing network interfaces.
  • If an interface has been used recently, it’s listed in the /private/var/db/dhcpclient/leases directory.
  • /private/var/db/DirectoryService/flatfile.db— A list of users on a system.
  • /private/var/db/dslocal/nodes/Default/users — Contains users’ plist files in Mac OS X after v10.7.
  • /private/var/db/shadow/hash — Contains account passwords.
• FileVault: Used to encrypt and decrypt a user’s /users directory. It has master keys and recovery keys, which research later proved could be retrieved from RAM and used to crack encryption.
• KeyChains: Used to manage passwords for applications, websites and other system files.

Acquisition Methods in macOS

• BlackBag Technologies distributes acquisition tools for OS 9 and OS X and provides MacQuisition, a forensic boot CD for creating drive images.

• After an acquisition has been made, the image of the file system is examined with a forensics instrument.

• If you made a raw format image, you can use any of the following tools:

  • BlackBag Technologies Macintosh Forensic Software (OS X only)
  • SubRosaSoft MacForensicsLab (OS X only)
  • Guidance Software EnCase
  • Recon Mac OS X Forensics with Palladin
  • X-Ways Forensics
  • AccessData FTK