Guide to Computer Forensics and Investigations, Sixth Edition 7-1

Chapter 7
Linux and Mac File Systems

At a Glance

Instructor’s Manual Table of Contents

 Overview

 Objectives

 Teaching Tips

 Quick Quizzes

 Class Discussion Topics

 Additional Projects

 Additional Resources

 Key Terms

© 2019 Cengage Learning. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part, except for
use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for school-approved
learning management system or classroom use.
Guide to Computer Forensics and Investigations, Sixth Edition 7-2

Lecture Notes

Overview
Chapter 7 continues exploring file systems by examining Linux and macOS file
structures. In addition, this chapter gives you an overview of basic Linux commands as
well as freeware and shareware tools. Chapter 7 also gives you an introduction about
how data is stored in the macOS and how to retrieve it, which is relevant with iPhones
and iPads becoming such popular mobile devices. Finally, this chapter introduces some
hands-on approaches to identifying Linux file structures with different forensics tools.

Chapter Objectives
 Describe Linux file structures
 Describe Macintosh file structures
 Use Linux forensics tools

Teaching Tips
Examining Linux File Structures

1. Explain that UNIX was created to be a multiuser, multithreaded, secure OS and that
many UNIX-based OSs followed. Point out that Linux is available in more flavors than
UNIX and that the Linux kernel is usually packaged with other software components.

2. Use Tables 7-1 and 7-2 to discuss important Linux system files and core top-level
directories of a Linux system.

3. Guide students through the activity starting on page 308 to create a virtual machine that
can run Ubuntu 16.04.

4. Once students have access to Ubuntu 16.04, have them complete the next activity,
which will give students a chance to review Linux commands, including:
a. uname –a
b. pwd
c. ls –l
d. ls –ul filename
e. ifconfig

File Structures in Ext4

1. Describe the Linux file system Ext2fs and its journaling version Ext3fs. Highlight the
use of inodes, metadata, and data as part of the files structure.

© 2019 Cengage Learning. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part, except for
use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for school-approved
learning management system or classroom use.
Guide to Computer Forensics and Investigations, Sixth Edition 7-3

Read more about Ext2, Ext3 and Ext4 at:

Teaching
Tip [Link]
[Link]

2. Explain that Ext4 file system added support for partitions larger than 16 TB and is now
considered the standard file system for most distributions.

3. Discuss the following four components that define the file system:
a. Boot block – contains the bootstrap code (instructions for startup)
b. Superblock – contains information about the system and is considered part of the
metadata
c. Inode blocks – contain the first data after the superblock
d. Data blocks – where directories and files are stored on the disk drive

4. Explain that the main purpose of inodes is to link data stored on data blocks.

5. Point out that when a file or directory is created on a Linux file system, an inode is
assigned that contains the following information:
 The mode and type of the file or directory
 The number of links to a file or directory
 The UID and GID of the file’s or directory’s owner
 The number of bytes in the file or directory
 The file’s or directory’s last access time and last modified time
 The inode’s last file status change time
 The block address for the file data
 The indirect, double-indirect, and triple-indirect block addresses for the file data
 Current usage status of the inode
 The number of actual blocks assigned to a file
 File generation number and version number
 The continuation inode’s link

6. UNIX/Linux file systems use inodes that implement direct, indirect, double-indirect,
and triple-indirect pointers. Use Figure 7-3 to illustrate the use of these pointers when
handling large size files.

7. Define bad blocks and how they can be used on Linux to hide information. Mention that
students can use the badblocks command to find bad blocks on a Linux computer.
Point out that the user must log in as root to do so. There are two other commands that
supply bad block information: mke2fs and e2fsck.

Teaching Your students can consult [Link]/tips/understanding-unixlinux-

Tip [Link] for additional explanations about the UNIX/Linux file
system.

© 2019 Cengage Learning. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part, except for
use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for school-approved
learning management system or classroom use.
Guide to Computer Forensics and Investigations, Sixth Edition 7-4

8. Discuss a hard link, which is a pointer that allows accessing the same file by different
filenames. Mention that filenames refer to the same inode and physical location on a
drive.

9. Use Figure 7-4 to view three hard-linked files pointing to the same inode: 23509. Be
sure to mention that you use the ln command to create a hard link and that the main
requirement is that all files pointing to the same inode have to be on the same physical
drive.

10. Explain that inside each inode is a field called link count that specifies the number of
hard links.

11. Discuss symbolic links, which are simply pointers to other files and aren’t included in
the link count. Mention that they can point to items on other drives or other parts of the
network. Symbolic links can be created with the ln –s command.

12. Guide students through the activity starting on page 317 so they may see how hard and
symbolic links work.

Quick Quiz 1
1. The term _____ is often used when discussing Linux because technically, Linux is only
the core of the OS.
Answer: kernel

2. Adoption of the _____ file system was slower in some distributions, but it’s now
considered the standard file system for most distributions.
Answer: Ext4

3. ____ contain file and directory metadata and provide a mechanism for linking data
stored in data blocks.
Answer: Inodes

4. Where does Linux keep a record of bad sectors?

Answer: Bad block inode

5. Unlike hard links, _____ can point to items on other drives or other parts of the
network.
Answer: symbolic links

Understanding Macintosh File Structures

1. Introduce macOS to your students and provide a little history about the Hierarchical
File System (HFS) and HFS+, the file systems used by Mac.

© 2019 Cengage Learning. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part, except for
use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for school-approved
learning management system or classroom use.
Guide to Computer Forensics and Investigations, Sixth Edition 7-5

Teaching Read more about the Hierarchical File System (HFS) at:
Tip [Link]
mactech/Vol.01/01.12/HFSFileStructure/.

An Overview of Mac File Structures

1. Explain that in older versions of macOS, a file consists of two parts: the data fork and
resource fork, where file metadata and application information are stored. Use Figure 7-
9 to illustrate your explanation.

2. Define a volume as any storage medium used to store files. A volume can be all or part
of the storage media for hard disks; however, in Mac OS 9 and earlier, a volume on a
floppy disk was always the entire disk.

3. Use Figure 7-10 to show the relationship between allocation and logical blocks. Logical
blocks cannot exceed 512 bytes. Allocation blocks are a set of consecutive logical
blocks.

4. Describe the following two types of end of file (EOF) descriptors, using Figure 7-11 in
your discussion:
a. Logical EOF
b. Physical EOF

5. Define clumps as groups of contiguous allocation blocks. Clumps are used to reduce
fragmentation.

6. Discuss the following terms and their functions on macOS:

a. Boot blocks
b. Master Directory Block (MDB) or Volume Information Block (VIB)
c. Volume Control Block
d. Extents overflow file
e. Catalog
f. Volume Bitmap
g. B*-tree

Forensic Procedures in Mac

1. Discuss some of the differences between the Linux and Mac OS X file systems:
 Linux has the /home/username and /root directories
 In macOS, the corresponding folders are /users/username and
/private/var/root
 The /home directory exists in macOS, but it’s empty
 macOS users have limited access to other user accounts’ files and the guest
account is disabled by default
© 2019 Cengage Learning. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part, except for
use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for school-approved
learning management system or classroom use.
Guide to Computer Forensics and Investigations, Sixth Edition 7-6

2. Emphasize that for forensics procedures in macOS, you must know where file system
components are located and how both files and file components are stored. Point out
that application settings are in three formats: plaintext, plist files, and the SQLite
database.

3. Discuss plist files, which are preference files for installed applications on a system.
Point out to students the list of other files that might contain information useful for an
investigation (found on page 324).

4. Mention that FileVault, introduced with version 10.3, is used to encrypt and decrypt a
user’s /users directory. FileVault2 was introduced to address security vulnerabilities
found in the first version of FileVault.

5. Discuss keychains, which are used to manage passwords for applications, Web sites,
and other system files.

6. Explain that to examine a computer running macOS, you need to make an image of the
drive. Removing the drive from a Mac Mini case is difficult, and attempting to do so
without Apple factory training could damage the computer. A MacBook Air poses
similar problems, as you need special Apple screwdrivers to open the case.

7. Mention that you need a macOS-compatible forensic boot CD/DVD to make an image.

8. Explain that BlackBag Technologies sells acquisition tools for OS 9 and OS X. For
example, MacQuisition is a forensic boot CD that makes an image of a Mac drive.

Teaching You can get a copy of MacQuisition at its official Web site:
Tip [Link]

9. Explain that after making an acquisition, the next step is to examine the image of the
file system. The tool you use depends on the format of the image file.

10. If you made a raw format image, you can use any of the following tools:
a. BlackBag Technologies Macintosh Forensic Software (OS X only)
b. SubRosaSoft MacForensicsLab (OS X only)
c. Guidance Software EnCase
d. Recon Mac OS X Forensics with Palladin
e. X-Ways Forensics
f. AccessData FTK

11. Explain that BlackBag Technologies Macintosh Forensic Software and SubRosaSoft
MacForensicsLab have a feature for disabling and enabling Disk Arbitration.

© 2019 Cengage Learning. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part, except for
use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for school-approved
learning management system or classroom use.
Guide to Computer Forensics and Investigations, Sixth Edition 7-7

12. Mention that being able to turn off the mount function in OS X allows you to connect a
suspect drive to a Mac without a write-blocking device.

Using Linux Forensics Tools

1. Mention that most commercial computer forensics tools can analyze Ext2, Ext3, Ext4,
ReiserFS, and Reiser4 file systems. Freeware tools include Sleuth Kit and its Web
browser interface, Autopsy Browser.

2. Define Foremost as a freeware carving tool that can read many image file formats. It
has a configuration file called [Link].

3. Define a tarball as a highly compressed data file containing one or more files or
directories and their contents.

Installing Sleuth Kit and Autopsy

1. Use Figures 7-12 and 7-13 to explain how to install Sleuth Kit and Autopsy.

Teaching Mention that Sleuth Kit must be installed before Autopsy Browser, or Autopsy
Tip won’t be installed correctly.

Examining a Case with Sleuth Kit and Autopsy

1. Use Figures 7-14 and 7-15 to describe how to use Sleuth Kit and Autopsy Browser to
analyze an older Linux file system.

2. Mention that Kali Linux has several forensics tools in its arsenal. Use Figures 7-16 and
7-17 to illustrate your explanation.

Quick Quiz 2
1. The current Macintosh OS is macOS, version 10.13, code-named ____.
Answer: High Sierra

2. The _____ typically contains data the user creates, such as text or spreadsheets.
Answer: data fork

3. In Mac, a group of consecutive logical blocks is known as a(n) _____.

Answer: allocation block

4. The _____ is used to store any file information not in the MDB or a VCB.
Answer: extents overflow file
© 2019 Cengage Learning. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part, except for
use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for school-approved
learning management system or classroom use.
Guide to Computer Forensics and Investigations, Sixth Edition 7-8

5. Since Mac OS 8.6, _____ have been used to manage passwords for applications, Web
sites, and other system files.
Answer: keychains

Class Discussion Topics

1. Ask students to compare HFS+, Ext4fs, and NTFS. Ask your students to choose which
they consider the most reliable file system and justify their answers.

2. Ask students to compare inodes used in Linux and NTFS. Are they the same? If not,
which one is better?

Additional Projects
1. Ask students to read more about UNIX and Linux. Ask them why they believe most
UNIX distributions are no longer available.

2. Ask students to investigate the following tools and report on the different features
offered in each:
 Guidance Software EnCase
 X-Ways Forensics
 AccessData FTK

Additional Resources
1. Mac Hierarchical Filesystem – HFS:
[Link]

2. BlackBag Technologies:
[Link]/[Link]

3. UNIX Web sites:

a. OpenBSD, [Link]/
b. FreeBSD, [Link]/
c. IBM AIX, [Link]/servers/aix/
d. Solaris, [Link]

4. inode:
[Link]

5. Foremost:
[Link]
© 2019 Cengage Learning. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part, except for
use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for school-approved
learning management system or classroom use.
Guide to Computer Forensics and Investigations, Sixth Edition 7-9

Key Terms
 allocation block — In the Mac file system, a group of consecutive logical blocks
assembled in a volume when a file is saved. See also logical block.
 Apple File System (APFS) — A macOS file system introduced with macOS High
Sierra.
 B*-tree — A macOS file that organizes the directory hierarchy and file block mapping
for File Manager. Files are represented as nodes (objects); leaf nodes contain the actual
file data.
 bad block inode — In the Linux file system, the inode that tracks bad sectors on a
drive.
 boot block — A block in the Linux file system containing the bootstrap code used to
start the system.
 catalog — An area of the macOS file system used to maintain the relationships between
files and directories on a volume.
 clumps — In the macOS file system, groups of contiguous allocation blocks. Clumps
are used to keep file fragmentation to a minimum.
 data block — A block in the Linux file system where directories and files are stored on
a drive.
 data fork — The part of a macOS file containing the file’s actual data, both user-
created data and data written by applications. The data fork also contains the resource
map and header information, window locations, and icons, as does the resource fork.
See also resource fork.
 double-indirect pointers — The inode pointers in the second layer or group of an OS.
See also inodes.
 Extended Format File System (HFS+) — File system used by Mac OS 8.1 and later.
HFS+ supports smaller file sizes on larger volumes, resulting in more efficient disk use.
 extents overflow file — A file in HFS and HFS+ that’s used by the catalog to
coordinate all file allocations to the volume. File Manager uses this file when the list of
a file’s contiguous blocks becomes too long for the catalog. The list’s overflow is
placed in the extents overflow file. Any file extents not in the MDB or a VCB are also
contained in this file. See also catalog, Master Directory Block (MDB), and Volume
Control Block (VCB).
 Fourth Extended File System (EXT4) — A Linux file system that added support for
partitions larger than 16 TB, improved management of large files, and offered a more
flexible approach to adding file system features.
 hard link — In the Linux file system, a pointer that allows accessing the same file by
different filenames, which refer to the same inode and physical location on the drive.
 header node — A node that stores information about the B*-tree file. See also B*-tree.
 Hierarchical File System (HFS) — The system Mac OS uses to store files, consisting
of directories and subdirectories that can be nested.
 index node — AB*-tree node that stores link information to the previous and next
nodes. See also B*-tree.
 indirect pointers — The inode pointers in the first layer or group of an OS.
 inode blocks — Blocks in the Linux file system that contain the first data after the
superblock and consist of a grouping of inodes. See also inodes.
© 2019 Cengage Learning. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part, except for
use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for school-approved
learning management system or classroom use.
Guide to Computer Forensics and Investigations, Sixth Edition 7-10

 inodes — A key part of the Linux file system, these information nodes contain
descriptive file or directory data, such as UIDs, GIDs, modification times, access times,
creation times, and file locations.
 keychains — A macOS feature used to track a user’s passwords for applications, Web
sites, and other system files.
 link count — A field in each inode that specifies the number of hard links. See also
hard link.
 logical block — In the macOS file system, a collection of data that can’t exceed 512
bytes. Logical blocks are assembled in allocation blocks to store files in a volume. See
also allocation blocks.
 logical EOF — In the macOS file system, the actual ending of a file’s data.
 map node — A B*-tree node that stores a node descriptor and map record. See also B*-
tree.
 Master Directory Block (MDB) — On older Mac systems, the location where all
volume information is stored. A copy of the MDB is kept in the next-to-last block on
the volume. Called the Volume Information Block (VIB) in HFS+.
 physical EOF — In the macOS file system, the number of allocation blocks assigned to
a file.
 plist files — In macOS, preference files for installed applications on a system.
 resource fork — The part of a macOS file containing file metadata and application
information, such as menus, dialog boxes, icons, executable code, and controls. The
resource fork also contains the resource map and header information, window locations,
and icons, as does the data fork. See also data fork.
 Second Extended File System (Ext2) — An early Linux file system.
 superblock — A block in the Linux file system that specifies and keeps track of the
disk geometry and available space and manages the file system.
 symbolic links — Pointers to other files; they can point to items on other drives or
other parts of the network and don’t affect the link count. See also hard link.
 tarball — A highly compressed data file containing one or more files or directories and
their contents.
 Third Extended File System (Ext3) — A Linux file system that made improvements
to Ext2, such as adding journaling as a built-in file recovery mechanism.
 triple-indirect pointers — The inode pointers in the third layer or group of an OS.
 unified logging — A new feature in macOS located in /var/db/diagnostics and
/var/db/[Link]. It includes three new utilities—log, log collect, and log show
—that a forensics examiner can use.
 Volume Control Block (VCB) — An area of the Mac file system that contains
information from the MDB and is used by File Manager. See also Master Directory
Block (MDB).

© 2019 Cengage Learning. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part, except for
use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for school-approved
learning management system or classroom use.