Chapter 1 Macintosh OS X Boot Process and Forensic Software Solutions in this chapter: ■ The Boot Process ■ The Macintosh Boot Process ■ Macintosh Forensic Software ˛ Summary 1 00000779308.INDD000779308.INDD 1 44/4/2008/4/2008 112:53:592:53:59 PPMM 2 Chapter 1 • Macintosh OS X Boot Process and Forensic Software Introduction “The computer for the rest of us” was never considered much of a hacker’s platform. The original Mac didn’t even have arrow keys (or a control key, for that matter), forcing the user to stop what he was doing, take his hands off the keyboard, and use the mouse. The Mac’s case was sealed so tight, a special tool known as the “Mac cracker” was made to break it open. It was a closed machine, an information appliance. The expansionless design and sealed case of the Mac stood in stark contrast to the Apple II that came before it. With its rich graphical interface and ease of use, the Mac became the standard for graphic artists and other creative types. Custom icons and desktop patterns soon abounded. The users that embraced the Macintosh for its simplicity began using ResEdit (Resource Editor) to modify system fi les and to personalize their machines. The Mac developed a fanatical following, and you could rest assured that each fanatic’s system was unique, with the icons, menus, program launchers, windows, sounds, and keyboard shortcuts all scrutinized and perfected to meet his personal needs. My Color Classic even played Porky Pig’s “That’s all folks” each time it shut down (although the novelty wore off on that one pretty quick…). Mac OS X was met with some trepidation. It broke every program and system modifi cation, it didn’t have a proper Apple menu — and what on earth was this “dock”? Jef Raskin, who gave the Mac its name, wrote of Mac OS X, “Apple has ignored for years all that has been learned about developing UIs. It’s unprofessional, incompetent, and it’s hurting users.” Bruce Tognazzini, founder of the Apple Human Interface Group, even penned an article titled “Top 10 Reasons the Apple Dock Sucks.” Mac OS X was an entirely different operating system. Most classic Mac OS appli- cations were compatible, but only when operating inside a special run-time environ- ment. All system extensions and user interface modifi cations were permanently lost. For many users, these changes are what made the computer “theirs” and they replied heavily upon their customizations to effi ciently get work done. The loss was tremen- dous. And it was worth it. Preemptive multitasking, symmetric multiprocessing, multithreading, and protected memory... Protected memory was the one I wanted most. At a 1998 keynote, Steve Jobs showed off a mere dialog box, to great applause. The dialog read: “The application Bomb has unexpectedly quit. You do not need to restart your computer.” I take it for granted on Mac OS X, but as I write this, I’m recalling occasions when Internet Explorer brought my entire system down multiple times in a single day. www.syngress.com 00000779308.INDD000779308.INDD 2 44/4/2008/4/2008 112:54:002:54:00 PPMM Macintosh OS X Boot Process and Forensic Software • Chapter 1 3 Protected memory doesn’t do much good when all your apps are running in the Classic Environment and the user interface did indeed leave a lot to be desired. But with each revision, Mac OS X has improved dramatically. The Macintosh has become “the computer for everybody.” For novices, it remains the easiest computer there is. For enthusiasts, as in the old days, there is a vast array of third party applications, utilities, and customizations, to tweak and improve the way the OS works. For hackers and programmers, there’s the command line and the BSD Unix compatibility layer. All the power, all the tools, and all the geekery of Linux is present in Mac OS X. Shell scripts, X11 apps, processes, kernel extensions… it’s a UNIX platform. It’s even possible to forgo Apple’s GUI altogether and run KDE. Why you’d want to is another matter. While its UNIX core is what has made Mac OS X a viable platform for hackers and programmers, it’s the user interface that has made it popular. Apple’s Terminal application is perpetually running on my PowerBook, but so is iTunes, iCal, and a slew of Dashboard Widgets. The Boot Process In this section we will look at the startup process that most computers go through and how the fundamental operating systems get loaded and started. You will see that computers start with tiny steps that build on each other, getting larger until the entire system is loaded and running. Only then can you, the end user, issue commands that the computer interprets and understands. One of the most popular analogies for how a computer starts up is the amnesia scenario. For a moment look around you at the things you use everyday: telephones, pencils, coffee cups, and so on. Now imagine that you closed your eyes and when you opened them you didn’t recognize any of those things, and didn’t know how they worked. That is what happens inside a computer when you press the reset or the power button. At the most fundamental level, computers understand only two things: true and false. The process of getting the computer from being a completely blank state to a fully running operating system is one of the fundamental items that every investigator should understand. After looking at how a Macintosh boots, we will look at some of the tools that are available for analyzing Macintosh systems using both the Macintosh and Windows operating systems. The term “boot,” depending on whom you talk to, came either from the old phrase, “Pulling one’s self up by the bootstraps,” or just from the word “bootstrap,” www.syngress.com 00000779308.INDD000779308.INDD 3 44/4/2008/4/2008 112:54:002:54:00 PPMM 4 Chapter 1 • Macintosh OS X Boot Process and Forensic Software meaning the leather tabs you use to pull on your boots. Either way it is a part of computer history and lore and is commonly used as the computer term for the initial startup of the system. All systems that are able to run Microsoft or Linux operating systems use the same boot up process. Once the computer completes this initial startup the specifi c operating system will load what it needs to continue. First we will look at the boot process in detail. The Macintosh Boot Process In this section, we will briefl y examine the way an Apple Macintosh computer boots. The information here is for the Mac OS X version of their operating system using Intel based microprocessors. Older Motorola chipset Macintosh computers use a much different boot process. OS X uses Open Firmware that is very much like the BIOS noted earlier. The Open Firmware that Apple uses in the Macintosh is based on the IEEE-1275 standard. EFI and BIOS: Similar but Different Just like any other computer on the market, when the power switch is activated on a Macintosh, the system goes through a Power On Self Test (POST), resets the micro- processor, and starts the execution of initialization code, which is the Open Firmware instead of BIOS. Like the BIOS, Extensible Firmware Interface (EFI) checks the confi guration of the machine and loads any device ROMs that it fi nds into memory. It then looks for a default boot device… and here is where it gets interesting. There are numerous optional startup functions that EFI can perform based on user input. Single keys, known as “snag keys,” can be pressed that will allow the system to boot from specifi c devices. ■ Pressing the C key will attempt to boot from the CD/DVD-ROM drive. ■ Pressing the D key will attempt to boot from the fi rst hard disk drive. ■ Pressing the N key will attempt to boot from the Network Interface Controller (NIC). ■ Pressing the Z key will attempt to boot from the ZIP drive. www.syngress.com 00000779308.INDD000779308.INDD 4 44/4/2008/4/2008 112:54:002:54:00 PPMM Macintosh OS X Boot Process and Forensic Software • Chapter 1 5 It is also possible to enter the EFI interactive console mode by pressing the cmd-opt-O-F key combination during power up. (Note: If you are like me and just tried this before reading on, typing mac-boot at the prompt will let the Macintosh fi nish booting.) You should read a good source of Open Firmware/EFI commands before trying the console mode. An excellent mirror of the Open Firmware Working Group is at http://bananjr6000.apple.com/1275/ . The EFI program is located in the BOOT.efi fi le. This is the portion of the boot loading process that loads the OSX kernel and starts the user interface. DARWIN To many die-hard Macintosh users the move to OS X wasn’t immediately seen as a move to the open source UNIX environment. It wasn’t long before they realized their beloved Mac was now a UNIX machine. When you look at the roots of OS X, a large number of open source modules and programs were obtained from other groups includ- ing Carnegie Mellon, FreeBSD, GNU, Mach, Xfree86, NEXTSTEP, and OPENSTEP. The OS X Kernel In a nutshell the real OS X is when the combination of several components come together. XNU is the actual OS X kernel name on the boot drive.