Chapter 5

The Boot Process and the Master Boot Record (MBR)

Review• We discussed the relevance of HEX when examining

file signature metadata.• We discussed complex files including compound and

compressed files, files that contain even more data which is not legible in a text based code, specifically the instructions on how to assemble the complex file.

• We discussed how complex files needed to be “mounted” in order for the data to be “extracted” or “assembled”.

• Mounting a file is the process of making a file ready to be used by compatible software.

Mount• Mounting is the process of taking the raw data

contained on a hard-drive or other storage media and making it accessible and useable.

• Process of taking magnetically store 1’s and 0’s and converting them back to files and folders. Understandable by the user.

• It is the mounting process, which identifies or defines the boundaries of the computer’s data or file system.

Computer first turned on• When a computer is first turned on, it needs

to mount a primary file system first, a file system containing an operating system by which the computer can be operated.

Booting-up • The booting up process and the associated

Master Boot Record (MBR) and their importance in understanding the essentials of the cyber forensic process will be discussed in this chapter.

• We will also be discussing BIOS (Basic Input Output System).

• All systems must boot up and all systems have file systems.

Primary Functions of the Boot Process• POST – Power On Self Test – self diagnostic

program used to perform a single test of the CPU, RAM, and various Input/Output devices.

• To explain partitions and volumes, we need to first explain how partitions and volumes are mounted and booted.

• POST is store in ROM BIOS.

BIOS

• Once the Operating System is loaded, it is now possible to run, store, alter and save data.

• It is extremely important to understand that when files are accessed changes occur; metadata such as accessed time and modified times are altered.

BIOS/CMOS Setup Menu• Program used to display and edit user

configuration setting in the BIOS of the PC.– Change boot order– Adding new drive– Etc..

• The BIOS setup sometimes referred to CMOS setup or CMOS RAM because user settings were initially held in a tiny, battery-backed CMOS memory bank that is part of the PC’s real-time clock circuit.

• Boot can be change from any source floppy drive, CD drive, USB drive, Hard Drive etc…

First Boot Sequence• The BIOS determine which boot device will

load called “First Boot Sequence”.• The First Boot Sequence is the order the

computer uses to look for the operating system.

• It will search in the order selected if it can’t find the first device.

• Primarily the computer boots from the hard disk drive.

BIOS and Forensics

• Verify and validate the system clock. – Not 100 percent accurate– Bad CMOS Battery

• Computer may need a stand-alone boot disk.• Might not want to boot using the evidence

drive.

Forensic Imaging and Evidence Collection

• As an forensics investigator, you maybe required for collecting and capturing evidence.

• Understanding that data can be written to a hard drive (evidence) during the boot process is critical as this alters the evidence.

• Knowing when and how data is altered on a piece of evidence (hard drive or otherwise) is not only important when investigating evidence, but also important when acquiring evidence.

Forensic Investigator

• Booting up a computer can contaminate the evidence.

• A defense lawyer will discredit you and even get the evidence thrown out because it was altered or tampered with by booting the computer up.

• Can ruin your career as an investigator.

Write Blocker

• Device connected to a evidence hard drive by the investigator to prevent data from being altered.

• Write blocker will allow a driver to be powered on and copied but will block any writing attempts (accidently or intentionally) directly on the evidence drive.

Write Blocker

• Allows the hard drive to be powered up and read but not written to.

• Data, usually at the bit level as binary, is then “copied” from an evidence drive to the storage area.

• Sometimes this is not practical, as where the hard drive may be so imbedded in a laptop that removing it would require dismantling the laptop. (MACs or Sony VAIO)

Reasons to remove Hard Drive1. State-of-the-Art computer containing new hard drive technology with cutting edge bus adapter ( a port which receives data cable) for which there is no write blocker adapter.2. An older computer with a hard drive for which an adapter may not exist.3. A server may have multiple disk drives (HDD) configured as a single logical hard drive (as a RAID array) where an adapter for a peculiar HDD is not at hand.

Connecting to a Write Blocker for imaging may not be an option

• When this is the case, the computer needs to be powered on, without booting or the hard drive’s operating system thereby avoiding tainting potential evidence.

• Understanding the BIOS may be extremely beneficial if not imperative when collecting this evidence.

Boot Sequences• The Boot Sequence is altered so that the BIOS

hands control over to the investigation’s operating system, found on the floppy disk, USB, or compact disc and not to the operating system found on the hard disk, that is the evidence.

• This allows system to continue to boot up without the internal operating system interfering with the evidence.

• This allows the forensic investigator access to the data contained on the system without altering the evidence contained on the hard drive.

Summarizing the BIOS• POST – test computer hardware, ensuring hardware is

properly functioning before starting the process of loading the operating system.

• Bootstrap Loader– The process of locating the operating system. If a capable operating system is located. BIOS will pass the control to it.

• BIOS – Software/Drivers that interface between the operating system and your hardware. When running DOS or Windows you are using complete BIOS support.

• BIOS/CMOS Setup – A configuration program that allows you to configure hardware setting including system setting such as computer passwords, time , and date.

BIOS Setup Utility: Step by Step• BIOS is accessed at startup. • As soon as you turn on your PC, a short text

will appeared quickly on the screen indicating which key to press to enter the BIOS.

• Usually the (DEL, F1, F2, F12 key etc…)• Different systems will have different keys or

key strokes to enter the BIOS

Pressing the Key• Interrupts the boot process and enter the

BIOS.• The main screen for the BIOS appears.• Enables you to access other sections of the

BIOS.• The system clock can be verified and/or

altered usually in the main screen.

BIOS Versions

• There are many different versions of BIOS and may not look the same.

• BIOS is an important part of forensics and should not be skipped.

• Let the system Boot up may result in files being change

Phase Two of the Boot Process

• Once all of the tests ensure that the hardware is properly functioning and before starting the process of loading the operating system, the physical drives are enumerated and the boot code attempts to find and load an operating system or software utility.

• Once this has transpired the boot process terminates and the primary drives is active.

• Writing and changes to the primary drive is active!

Phase Two

• Accessing BIOS halts the boot process and prevents the boot code from accessing the primary drive.

• The second phase is the process after leaving BIOS continuing to the primary drive which changes to the drive would be made.

• These changes can be unintentional and cause loss of integrity to the data and evidence.

• Member, a lawyer only has to prove that the evidence was tampered with and may not be reliable to get it thrown out as evidence.

Integrity of the Evidence

• As a forensic investigator, knowing the boot sequence and knowing how to navigate BIOS is a very important.

• Knowing BIOS and how it is configured is very important to forensic investigator.

Master BOOT Record (MBR)

• Second Phase - of the booting process that the BIOS contained within these Intel base computers, it will load the first sector of the Hard Drive into memory.

• First Sector is called the Master Boot Record (MBR).

3 Components to the Master Boot Record

1. A small amount of executable code called the master boot code.

2. The disk signature3. The partition table for the disk

Boot Loader

• The boot loader works by looking for the active partition in the partition table and loading the first sector in that partition.

• Partition Boot Record is the first sector. • The Partition Boot Record will then start the

process of loading the operating system’s kernel.

Kernel• is a computer program that manages input/output requests from software, and

translates them into data processing instructions for the central processing unit and other electronic components of a computer. The kernel is a fundamental part of a modern computer's operating system.

• A kernel connects the application software to the hardware of a computer• The critical code of the kernel is usually loaded into a protected area of memory,

which prevents it from being overwritten by other, less frequently used parts of the operating system or by applications. The kernel performs its tasks, such as executing processes and handling interrupts, in kernel space, whereas everything a user normally does, such as writing text in a text editor or running programs in a GUI (graphical user interface), is done in user space. This separation prevents user data and kernel data from interfering with each other and thereby diminishing performance or causing the system to become unstable (and possibly crashing).

• When a process makes requests of the kernel, the request is called a system call. Various kernel designs differ in how they manage system calls and resources. For example, a monolithic kernel executes all the operating system instructions in the same address space in order to improve the performance of the system. A microkernel runs most of the operating system's background processes in user space, to make the operating system more modular and, therefore, easier to maintain

Disk Signature• The boot process (code) searches the available

drives (already identified in the BIOS) for an operating system.

• Once found, the operating system tests for the disk signature (an unique number at offset 0X01B8, which identifies the disk to the operating system.)

End of Sector Marker• The last two sectors of the MBR contain a two-

byte structure called a signature word (End of Sector Marker), which is always set to 0X55AA (HEX 55AA)

• A signature word also marks the end of an extended boot record (EBR) and the boot sector.

• HEX 55AA must be found in the last two bytes of this sector.

• The boot code searches for a bootable drive, which is identified by the value 0X55AA

Master Boot Code Activities• Scan the partition table for the active

partition.• Finds the starting sector of the active partition• Loads a copy of the boot sector from the

active partition into memory• Transfers control to the executable code in the

boot sector.

Errors

• If the master boot code cannot complete these functions, the system will display one of the following error message.– Invalid partition table– Error loading operating system – Missing operating system

First Sector of a Hard Drive

• Each square represents a single sector.• Sector contains 512 bytes • Remember, that the MBR’s signature bytes

are the final two bytes of the first sector

What is an Offset

• An offset within an array or other data structure object is an integer indicating the distance (displacement) from the beginning of the object up ( a base address) until a given element or point, presumably within the same object

• The concept of distance is valid only if all elements of the object are the same size (bytes and words)

Relative & Absolute address• Usually an 8 bit byte, is used to specify the offset’s

size. • Relative address – number that represents the

offset.• Absolute address – is derived by adding it relative

address to the base address. • Example: An Array of characters ABCDEF

• The element that contains C has an offset of 2 from the element containing A.

A B C D E F

0 1 2 3 4 5

Hex Editor

• Use to view and edit binary files.• Hex editors allow editing the raw data

contents of a file.• Hex Editor as known as Binary Editor • Hex Editor has 3 areas:– An Address area on the left– Hexadecimal Area in the middle– Character area on the right

Hex Editor is used for two reason

• Analyzing file structure. • Editing file contents.

MBR Contains 3 Components1. The Boot Loader –2. The Partition Table – 3. The Signature Bytes -

Boot Loader

• Loads the main operating system for the computer. Looks for the active partition of partition table and loads the first sector in that partition (Partition Boot Record) usually is an OS’s boot record. The Partition Boot Record will then start the process of loading the operating system’s kernel.

• The boot loader area is always 446 bytes (Byte offset 0-445 ) the number of bytes varies with the program that is installed in that area. (000 to 1B0 addresses)

• The above graphic Boot loader is the Yellow area 446 bytes.

Partition Table

• Partition Table - begins immediately after the boot loader area starts with a value of 0x80 that represents the active (bootable) partition.

• It contains four descriptors that are 16 bytes long each. • The descriptors represent the logical information needed to

access a partition on the drive. • The orange area is the Partition table starts with 0X80 HEX and

goes 16 bytes. Orange area

The Signature Byte

• Should always be 0X55AA in a Valid MBR highlighted in Red in the above picture.

• If the signature bytes are not 0x55AA, your hard drive will not boot.

Partition Table• Partition Table starts with the value of 0X80 that

represents the active (bootable) partition.• The Partition Table (P-Table) contains 4

descriptors that are each 16 bytes long for a total of 64 bytes. (446 – 509)

• The descriptors represents the logical information needed to access a partition on the drive.

• The Partition Table is part of the master boot record that describes how the disk is partitioned.

MBR

• The MBR reads the partition table to determine which partition is active (contains the OS) and where its boot sector is located.

• Boot Flag – is set to 0x80 HEX which is located at offset 446. • Drives can be single partitioned or multi-partitioned drive

Hard Disk Partition• A Hard Disk Partition is a defined storage space

on a hard drive.• Hard drives start with a single partition that

holds the operating system, your applications, games, music, photos, videos, and all your data.

• Over time your hard drive becomes very cluttered and messy: you can improve your hard drive’s speed and organization by separating your drive in partitions.

• Your computer will run faster and easier

Partition • Is created when you format the hard disk.

Typically, a one partition is labeled the “C:” drive (“A:” and “B:” are typically reserved for diskette drives)

• Two Partition would contain “C:” and “D:” drives

• A user may decide to split a hard disk into multiple partitions because smaller partitions often have smaller cluster sizes.

Cluster• A cluster is the unit of disk space allocation for

files and directories. To reduce the overhead of managing on-disk data structures, the filesystem does not allocate individual disk sectors, but contiguous groups of sectors, called cluster.

Cluster• On a disk that uses 512-byte sectors, a 512-byte cluster contains

one sector, whereas a 4-kibibyte (KiB) cluster contains eight sectors.

• A cluster is the smallest logical amount of disk space that can be allocated to hold a file. Storing small files on a filesystem with large clusters will therefore waste disk space; such wasted disk space is called slack space. For cluster sizes which are small versus the average file size, the wasted space per file will be statistically about half of the cluster size; for large cluster sizes, the wasted space will become greater. However, a larger cluster size reduces bookkeeping overhead and fragmentation, which may improve reading and writing speed overall. Typical cluster sizes range from 1 sector (512 B) to 128 sectors (64 KiB).

fdisk• Some operating systems uses fdisk command

to create hard disk partition. • Some will use graphical tools which creates

hard disk partition.

What’s a Logical Partition (aka Volume)?

1. A volume is how the operating system sees your free disk space.2. Volumes (also called logical drives) are represented in Windows by drive letters such as C:, K:,X:, etc…3. Volumes must be formatted with a file system before data can be stored on them.

The Signature Word• The signature bytes should always be 0X55AA

in a valid MBR. (Represents 2 Bytes)• If the signature bytes are not 0X55AA, your

hard drive will not boot until they are changed to hexadecimal number.

• Located at the end of the MBR location 510 & 511. There are 512 starting at 0

Summarizing the Boot Process

• BASIC INPUT/OUTPUT SYSTEM

• Power On Self Test

• Adjusted by User ( Hard Drive by default. (CD ROM, USB, Network …) It will start with the first and goes down the list in-order until it finds an OS.

Power ON

BIOS

POST

BIOS Boot Sequence

MBR

Summarizing the MBR• 3 main components– Boot Loader (Byte Offset 0-445)– Partition Table (Byte Offset 466-509)– Signature Bytes(Bytes Offset 510-511)

Byte Offset Description Size

0-445 Boot Loader 446 Bytes

446-509 Partition Table 64 Bytes

510-511 MBR Signature 2 Bytes

MBR Size 512

• Boot Loader (Byte offset 0-445)The MBR’s boot loader consists of code that the BIOS loads to boot an operating system. The boot loader works by looking for the active partition in the partition table and loading the first sector in that partition. That sector is known as the Partition Boot Record. The Partition Boot Record will then start the process of loading the operating system’s kernel.

• Partition Table (Byte offset 446-509). 64 bytes in length, consists of four 16 bytes entries (4x16=64) The partition table contains four descriptors that are 16 bytes long each. The table defines or describes the storage space or partition. The descriptors represent the logical information needed to access a partition on the drive. The partition table starts with a value of 80 (HEX), which represents the active (bootable) partition.

• Signature Bytes (Byte offset 510-511). The MBR’s signature bytes are the two final bytes of the first sector, and they are used as a simple validation of the MBR’s contents. When the MBR is loaded the BIOS checks the last two bytes of the sector. The last two sectors must contain the HEX values 55AA. If this boot record signature is not present, error messages such as “Insert boot disk” or “nonsystem boot” will appear.