GuidetoComputerForensicsandInvestigationsFourthEdition.pptVIP

Guide to Computer Forensics and Investigations * UNIX and Linux Overview (continued) Guide to Computer Forensics and Investigations * UNIX and Linux Overview (continued) Guide to Computer Forensics and Investigations * Understanding Inodes Link data stored in data blocks Ext2fs and Ext3fs are improvements over Ext Data recovery easier on Ext3fs than on Ext2fs First inode has 13 pointers Pointers 1 to 10 are direct pointers to data storage blocks Pointer 11 is an indirect pointer Pointer 12 is a double-indirect pointer Pointer 13 is a triple-indirect pointer Guide to Computer Forensics and Investigations * Guide to Computer Forensics and Investigations * Understanding Inodes (continued) Guide to Computer Forensics and Investigations * Understanding UNIX and Linux Boot Processes Instruction code in firmware is loaded into RAM Instruction code then: Checks the hardware Load the boot program Boot program Loads kernel Transfers control to kernel Kernel’s first task is to identify all devices Guide to Computer Forensics and Investigations * Understanding UNIX and Linux Boot Processes (continued) Kernel Boots system on single-user mode Runs startup scripts Changes to multiuser mode Identifies root directory, swap, and dump files Sets hostname and time zone Runs consistency checks on the file system and mounts partitions Starts services and sets up the NIC Establishes user and system accounting and quotas Guide to Computer Forensics and Investigations * Understanding Linux Loader and GRUB Linux Loader (LILO) Old boot manager Can start two or more OSs Uses configuration file Lilo.conf Grand Unified Boot Loader (GRUB) More powerful than LILO As LILO, it resides on MBR Command line or menu driven Guide to Computer Forensics and Investigations * Understanding UNIX and Linux Drives and Partition Schemes Labeled as path starting at root (/) directory Primary master disk (/dev/had) First partition is /dev/hda1 Second partition is /dev/hda2 Primary slave or secondary master or