Forensics Book 2: Investigating Hard Disk and File and Operating Systems Chapter 3: Windows, Linux, and Macintosh Boot Processes Objectives (Hedefler/Amaçlar) Understand boot loaders (önyükleyici) Understand boot sectors (önyükleme sektörü) Describe the basic system boot process (önyükleme işlemi) Explain the MS-DOS boot process Explain the Windows XP boot process Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Objectives (continued) Explain the Linux boot process Explain the Mac OS X boot process Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Introduction to Windows, Linux, and Macintosh Boot Processes This chapter: Focuses on the boot processes for the major operating systems available today Booting (Önyükleme, Başlatma), also called bootstrapping (Önyükleme, Başlatma) Process of loading an operating system into a computer’s main memory This step takes place during the boot sequence (önyükleme sırası) Set of steps a computer system takes after it has been powered on Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Boot Loader (önyükleyici) Boot loader or boot manager (önyükleme yöneticisi) Program that loads the operating system into a computer’s memory when the system is booted Multiple-stage boot loaders are common A number of small programs call each other, and the last program loads the operating system Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Boot Sector (önyükleme sektörü) Boot sector Memory sector of a hard disk, floppy disk, or similar data storage device that contains code for bootstrapping systems Always the first sector on the first track Each valid boot sector has two bytes (0x55AA), called a boot sector signature, at the end of the sector 0x55AA - önyükleme sektörü imzası Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Boot Sector (continued) Figure 3-1 This shows a boot sector, including the boot sector signature. Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Boot Sector (continued) Two major kinds of boot sectors: Volume boot record (disk bölümü önyükleme kaydı) Master boot record (Ana önyükleme kaydı) A master boot record contains the following structures: Master partition table (Ana bölüm tablosu) Master boot code (Ana önyükleme kodu) BIOS (Basic Input-Output System) (Temel Giriş-Çıkış Sistemi) Program a personal computer’s microprocessor uses to get the computer system started after a user turns it on EPROM adı verilen bir yonga üzerinde ROM Bellek (Read Only Memory, tr: Salt Okunur Bellek) biçiminde yer alan bir tür yazılımdır. Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Boot Sector (continued) Figure 3-2 This shows the code for a master boot record. Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Boot Sector (continued) CHS - Cylinder-head-sector LBA - Logical block addressing Figure 3-3 This shows the structure of a master boot record. Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Basic System Boot Process Steps: 1. The system clock generates a series of clock ticks, which initializes the CPU (Central Processing Unit) 2. The CPU looks to the system’s startup program in the ROM BIOS for its first instruction 3. The first instruction is to run the power-on self-test (POST), in a predetermined memory address 4. POST checks the BIOS chip and then tests CMOS RAM (Random access memory yani Rastgele Erişilebilir Bellek) CMOS (complementary metal-oxide semiconductor) memory holds the system date, time, and setup parameters Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Basic System Boot Process (continued) Steps: (continued) 5. If there is no battery failure, POST checks the inventoried hardware devices to check whether they are functioning properly 6. CPU initialization is completed if everything is fine 7. The BIOS looks into the CMOS chip to find the drive where the OS is installed The BIOS then checks the boot record of the drive to find the beginning of the OS and the subsequent program file that initializes the OS The BIOS copies its files into memory after OS initialization Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Basic System Boot Process (continued) Steps: (continued) 8. The OS takes over control of the boot process 9. The OS performs another inventory of the system’s memory and memory availability and loads the device drivers that it needs to control the peripheral devices Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited MS-DOS Boot Process Steps: The BIOS initiates power-on self-test (POST) POST performs the following actions: Initializes the keyboard and other system hardware, such as the video card Tests the computer’s RAM Checks the disk drives Attempts to find a valid operating system The BIOS searches for the file IO.SYS in the root directory and loads it into RAM IO.SYS provides services for peripherals such as printers, modems, and disk drives Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited MS-DOS Boot Process (continued) Steps: (continued) IO.SYS loads a file called MSDOS.SYS, which is an extension of ROM or the BIOS MSDOS.SYS acts as a gateway for communication between DOS and the BIOS MSDOS.SYS loads the CONFIG.SYS file CONFIG.SYS stores system configurations CONFIG.SYS is processed and executed MSDOS.SYS loads the COMMAND.COM program file into memory COMMAND.COM loads an optional file called AUTOEXEC.BAT and executes it Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Windows XP Boot Process Steps: The power supply performs a self-test and sends the power good signal to the processor The timer chip stops sending reset signals to the processor, allowing the CPU to begin operations The CPU loads the ROM BIOS starting at ROM memory address FFFF:0000 The ROM BIOS contains a JMP (jump) instruction that points to the actual address of the ROM BIOS code The ROM BIOS performs a basic test of central hardware to verify basic functionality Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Windows XP Boot Process (continued) Steps: (continued) The BIOS searches for adapters that may need to load their own ROM BIOS routines Startup BIOS routines scan memory addresses C000:0000 through C780:0000 to find video ROM The ROM BIOS checks to see if this is a cold boot (the startup of a system from a powered-down state) or a warm boot (the restart of a system that is already on) If this is a cold boot, the ROM BIOS executes a full POST (power-on self-test) If this is a warm boot, the memory test portion of the POST is switched off Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Windows XP Boot Process (continued) Steps: (continued) POST can be broken down into two components: A video test initializes the video adapter A video adapter tests the video card and video memory and displays configuration information or any errors The BIOS locates and reads the configuration information stored in CMOS The BIOS examines the disk for a master boot record (MBR) With a valid MBR loaded into memory, the BIOS transfers control of the boot process to the partition loader code Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Windows XP Boot Process (continued) Steps: (continued) The partition loader, or boot loader, examines the partition table for a partition marked as active The partition loader then searches the very first sector of that partition for a boot record. The active partition’s boot record is checked for a valid boot signature and, if found, the boot sector code is executed as a program Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Windows XP Boot Process (continued) Steps: (continued) NTLDR, a hidden system file in the root directory of the system partition, controls loading of Windows XP in four stages: Initial boot loader phase Operating system selection Hardware detection Configuration selection NTOSKRNL goes through two phases in its boot process I/O Manager starts loading all the system driver files Win32k.sys switches the screen into graphics mode Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Windows XP Boot Process (continued) Steps: (continued) The services subsystem starts all services marked as Auto Start Once all devices and services are started, the boot is deemed successful, and this configuration is saved as the last known good configuration The WINLOGON.EXE file starts the logon process This is a login manager file that is responsible for all login and logout procedures The Local Security Authority (LSASS.EXE) process displays the logon dialog box Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited FTK Imager (continued) Figure 3-5 This is the logon dialog box for Windows XP Professional. Copyright © by EC-Council Press All rights reserved. Reproduction is strictly prohibited Linux Boot Process The Linux boot process comprises five major steps: Step 1, boot manager: responsible for starting