1 / 63

COS/PSA 413

COS/PSA 413. Day 4. Agenda. Questions? Assignment 1 Corrected 3 A’s, 2 B’s, 2 C’s, 2 D’s and 1 F’s Assignment 2 posted Due in one week Lab Write-ups (project 2-1 and 2-2) due Lab tomorrow at OMS Project 2-5, Project 3-3, Project 3-4 (with modifications), Project 3-6

avari
Télécharger la présentation

COS/PSA 413

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. COS/PSA 413 Day 4

  2. Agenda • Questions? • Assignment 1 Corrected • 3 A’s, 2 B’s, 2 C’s, 2 D’s and 1 F’s • Assignment 2 posted Due in one week • Lab Write-ups (project 2-1 and 2-2) due • Lab tomorrow at OMS • Project 2-5, Project 3-3, Project 3-4 (with modifications), Project 3-6 • Begin Discussion on Macintosh and Linux Boot Process and Disk Structures • Chapter 4 in 1e and Chapter 8 in 2e

  3. Assignment 1 Analysis • Excessive Plagiarism • I do not accept “cut and paste” work from the web • Please review UMFK’s Academic Integrity Policy • Just changing the wording of something doesn’t mean you wrote it (http://www.mcctf.org/) • Further Infractions will receive formal charges of cheating filed with student conduct officer, Grades of Zero and possible dismissal from this class.

  4. Assignment 1 Answers • Assignment 1 answers • The are 3 Laws all from Chapter 18 of Title 17-A of the Maine Criminal Code • 432 Criminal Invasion of computer privacy (Class D) enacted 1989 • 433 Aggravated criminal invasion of computer privacy (Class C) enacted 1989 • 239 Solicitation of child by Computer to commit a prohibited Act (Class C) enacted in 2003 (2001) • Cases • There are about 12 that I know of. What I was looking for cases prosecuted under the laws you listed and properly cited. • Many listed cases that nothing to do with the laws they found • What are there not more cases, especially for 432 & 433 which have been around for 16 years?

  5. Macintosh and Linux Boot Process and Disk Structures Chapter 4

  6. Learning Objectives • Understand Macintosh Disk Structures • Explore Macintosh Boot Tasks • Examine UNIX and Linux Disk Structures • Understand UNIX and Linux Boot Processes • Examine Compact Disk (CD) Data Structures • Understand Other Disk Structures

  7. Understanding the Macintosh File Structure • Mac OS X version 10.3 • Darwin core • BSD UNIX application layer • Hierarchical File System (HFC) • Extended Format (HFC+) • File Manager and Finder • Data fork and resource fork

  8. Understand Macintosh File Structure (v ( and below) Hierarchical File System – The system used by the MAC OS to store files, consisting of folders and subfolders, which can be nested.

  9. Understand Macintosh File Structure File Manager – In Macintosh file system, it handles the reading, writing, and storage of data to physical media. It also collects data to maintain the HFS along with manipulation of files, folders, and volumes.

  10. Understand Macintosh File Structure Finder – Works with the Macintosh OS to keep track of files and maintain the user’s desktop.

  11. Understand Macintosh File Structure Data Fork – The part of the Macintosh file structure that contains the actual data of a file. Resource Fork – The part of the Macintosh file system that contains the resource map, header information for the file, window locations, and icons.

  12. Understand Macintosh File Structure

  13. Understand Macintosh File Structure • The resource fork contains the following information: • Resource map • Resource header information for each file • Window locations • Icons

  14. Understand Macintosh File Structure Volume – Refers to any storage media in the Macintosh file system. A volume can be a single floppy disk, a partition on a hard drive, the entire drive, or several drives.

  15. Understanding Volumes • Storage medium used to store files • A volume can be all or part of a hard disk • On a floppy disk, is always the entire disk • Multiple clients per volume • Allocation and logical blocks • Logical blocks cannot exceed 512 bytes • Allocation blocks are a set of logical blocks

  16. Understand Macintosh File Structure

  17. Understand Macintosh File Structure Allocation Blocks – The number of logical blocks assembled in the Macintosh file system when a file is saved. Logical Blocks – In the Macintosh file system, a collection of data that cannot exceed 512 bytes. These are assembled in allocation blocks to store files.

  18. Understand Macintosh File Structure

  19. Understand Macintosh File Structure Logical EOF – In the Macintosh file system, the number of bytes that contain data. Physical EOF – In the Macintosh file system, the number of allocation blocks assigned to the file. Difference between the two is free space

  20. Understand Macintosh File Structure

  21. Understand Macintosh File Structure Clumps – In the Macintosh file system, a contiguous allocation block. Clumps are used to keep file fragmentation to a minimum.

  22. Explore Macintosh Boot Tasks Master Directory Block (MDB) – On older Macintosh systems, the location where all information about a volume is stored. A copy of the MDB is kept in the next to the last block on the volume. Volume Information Block (VIB) – Another name for the Master Directory Block.

  23. Explore Macintosh Boot Tasks Extents Overflow File – Used by the Macintosh File Manager when the list of contiguous blocks of a file becomes too long. The overflow of the list is placed in the extents overflow file. Any file extents not in the MDB or VCB are contained here.

  24. Explore Macintosh Boot Tasks Volume Control Block (VCB) – Contains information from the MDB and is used by the File Manager in the Macintosh file system. Catalog –Is used to maintain the relationships between files and directories on a volume. Volume Bitmap – Tracks each block on a volume. B*-Tree –Organizes the directory hierarchy and file block mapping for the File Manager. Header Node – Stores information about the B*-Tree file.

  25. Exploring Macintosh Boot Tasks • Use Open Firmware • Processor- and system-independent firmware • Older Macintosh OSs • First two logical blocks are boot blocks • Master Directory Block (MDB) or Volume Information Block (VIB) • Extents overflow file • Volume Control Block (VCB)

  26. Exploring Macintosh Boot Tasks (continued) • Volume Bitmap • Tracks used and unused blocks on a volume • Mac OS 9 uses a B*-tree file system for File Manager • Actual file data is stored on the leaf nodes • Header, index, and map nodes

  27. Using Macintosh Forensic Software • For Mac OSs earlier that Mac OS x • Expert Witness originally from ASRData, now owned by Guidance Software • Black Bag Technologies tools • Deal specifically with files Macintosh hides • PhantomSearch • For Mac OS X • Almost any UNIX/Linux forensic tool

  28. Examining UNIX and Linux Disk Structures • UNIX flavors • System 7, SGI IRIX, Sun Solaris, IBM AIX, and HP-UX • BSD, FreeBSD, OpenBSD, and NetBSD • Linux distributions • Caldera, Red Hat, SuSe, Mandrake, and Debian • Most consistent UNIX-like OSs • GNU and BSD licenses

  29. Examining UNIX and Linux Disk Structures (continued)

  30. Examining UNIX and Linux Disk Structures (continued)

  31. Examining UNIX and Linux Disk Structures (continued) • Linux file systems • Second Extended File System (Ext2fs) • Ext3fs, journaling version of Ext2fs • Employs inodes • Pointer to other inodes or blocks • Keep internal link count • Deleted inodes have count value 0 • Linux file structure • Meta-data and data

  32. Examining UNIX and Linux Disk Structures (continued)

  33. UNIX and Linux Overview • Everything is a file • Files are defined as objects • UNIX consists of four components • Boot block • Disk allocation unit of at least 512 bytes • Contains the bootstrap code • Only one

  34. UNIX and Linux Overview (continued) • Superblock • Indicates disk geometry, available space, and location of the first inode • Manages the file system • Inode blocks • First data after the superblock • Assigned to every file allocation unit • Data blocks • Where directories and files are stored

  35. UNIX and Linux Overview (continued)

  36. UNIX and Linux Overview (continued) • Bad block inode • Keeps track of disk bad sectors • Commands: badblocks, mke2fs, and E2fsck/ • Linux ls command displays information about files • Continuation inode provides more information about a file or directory

  37. UNIX and Linux Overview (continued)

  38. UNIX and Linux Overview (continued)

  39. Understanding Inodes • Link data stored in data blocks • Ext2fs and Ext3fs are improvements over Ext • Data recovery easier on Ext3fs than on Ext2fs • First inode has 13 pointers • Pointers 1 to 10 are direct pointers • Pointer 11 is an indirect pointer • Pointer 12 is a double-indirect pointer • Pointer 13 is a triple-indirect pointer

  40. Understanding Inodes (continued)

  41. Understanding Inodes (continued)

  42. Understanding UNIX and Linux Boot Processes • Instruction code in firmware is loaded into RAM • Instruction code then • Checks the hardware • Load the boot program • Boot program • Loads kernel • Transfers control to kernel

  43. Understanding UNIX and Linux Boot Processes (continued) • Kernel • Boots system on single-user mode • Runs startup scripts • Changes to multiuser mode • Identifies root directory, swap and dump files • Sets host name, time zone • Runs consistency checks on the file system and mounts partitions • Starts services

  44. Understanding Linux Loader and GRUB • Linux Loader (LILO) • Old boot manager • Can start two or more OSs • Uses configuration file lilo.conf • Grand Unified Boot Loader (GRUB) • More powerful than LILO • As LILO resides on MBR • Command line or menu driven

  45. UNIX and Linux Drives and Partition Schemes • Labeled as path starting at root (/) directory • Primary master disk • First partition is /dev/hda • Second partition is /dev/hda2 • Primary slave or secondary master or slave • First partition is /dev/hdb • SCSI controllers • /dev/sda with first partition /dev/sda1

  46. Examining CD Data Structures • Laser burns flat areas (lands) • Lower areas are called pits • Transitions • From lands to pits have binary value 1, or on • No transition has binary value 0, or off • ISO standards • ISO 9660 for CD, CD-R, and CD-RW • ISO 13346 for DVDs

  47. Examining CD Data Structures (continued)

  48. Examining CD Data Structures (continued)

  49. Examining CD Data Structures (continued) • Frame is the unit storage • Contains 24 17-bit symbols • Frames are combined into blocks • Blocks are combined into sectors • 2352 bytes for CD-DA • 2048 bytes for CD • Constant Linear Velocity (< 12X) • Constant Angular Velocity (>= 12X)

  50. Understanding Other Disk Structures • SCSI disks • IDE/EIDE disks • RAID configurations

More Related