As the system boots up, IT Technician Smith oversees the Macintosh boot process. After the completion of the BootROM operation, control transitions to the BootX (PowerPC) or boot.efi (Intel) boot…

Question

Options

• AEFI initializes the hardware interfaces
• BBoot loader loads a pre-linked version of the kernel
• CSystem selects the OS
• DActivation of BootROM

• A
  11% (3)
• B
  71% (20)
• C
  4% (1)
• D
  14% (4)

Explanation

According to the CHFI v11 Operating System Forensics curriculum, understanding the macOS boot process is essential for identifying boot-level attacks, rootkits, and system tampering. The Macintosh boot sequence follows a clearly defined order, and each stage plays a critical role in system initialization. The process begins with BootROM, which performs initial hardware checks and firmware validation. On Intel-based Macs, BootROM invokes EFI (Extensible Firmware Interface), which initializes hardware interfaces and locates a valid bootloader. Once this phase is complete, control is handed over to the boot loader--either BootX (on older PowerPC systems) or boot.efi (on Intel-based systems). After the boot loader takes control, the next step is loading the pre-linked kernel. The boot loader loads a pre-linked kernel image, which includes the macOS kernel (XNU) along with essential kernel extensions (kexts) required for hardware and system functionality. CHFI v11 highlights this step as crucial because any compromise here can allow attackers to execute malicious code before user-level security controls are enforced.

No community discussion yet for this question.