ios boot process in detail

1. Boot ROM:
The boot process begins when the device is
powered on.
The Boot ROM (Read-Only Memory)
contains the immutable code necessary to
start the device.
Responsibilities:
Performs basic hardware
initialization.
Executes the next stage of the
boot process.
Key Points:
Immutable code, ensuring its
integrity.
Contains low-level initialization
routines specific to the device's
hardware.
2. Low-Level Bootloader (LLB):
The Boot ROM hands over control to the LLB, which is stored in flash
memory.
Responsibilities:
Performs more complex hardware initialization and verification.
Loads the next stage of the boot process, iBoot.
Key Points:
Ensures the hardware's integrity before proceeding further.
Provides basic functionality for loading subsequent boot stages.
3. iBoot:

iBoot is Apple's second-stage bootloader,

responsible for loading the iOS kernel and
initiating the software environment.
Responsibilities:

Verifies the integrity of the iOS

kernel and device firmware.
Initializes essential hardware
components.
Loads the kernel and prepares it
for execution.
Key Points:

Ensures a secure boot chain by

verifying the integrity of software
components.
Provides recovery mode
functionality for troubleshooting
and restoring the device.
4. iOS Kernel Initialization:

Once iBoot has loaded the kernel,

the iOS kernel initialization process
begins.
Responsibilities:
Sets up memory management and
virtual memory.
Initializes device drivers for
hardware components.
Starts essential kernel services.
Key Points:

Establishes a stable foundation for

the iOS operating system.
Manages the hardware resources
and interfaces with the underlying
hardware.
5. Launchd and User Space:

After the kernel initialization, the

system transitions to user space,
where user-level processes and
applications are launched.
Responsibilities:
Starts the launchd process, which
serves as the root process for user-
level services.
Launches system daemons and
user applications.
Key Points:

Establishes the user environment,

including launching essential
system processes like SpringBoard
(the iOS home screen).
6. User Interface Initialization:
Once the user space is initialized,
the device's graphical user
interface (GUI) components are
loaded and displayed.
Responsibilities:

Initializes the graphical

components of the iOS interface,
including SpringBoard and other
system apps.
Presents the lock screen or home
screen to the user.
Key Points:

Provides the user with access to

the device's functionality through
the graphical interface.
Completes the boot process,
allowing the user to interact with
the device.
iOS Architecture
The iOS operating system acts as an intermediary between the a
pplications running on the screen and the hardware components of the
device.
The iPhone has two partitions,
the iOS system partition and
the iOS data partition.
The contents of the iOS system partition, which is used for the
operating system and read-only for the user, may not be evidentiary,
but it may be necessary to examine it .
The iOS data partition is used as a read/write for the user and the
applications so the evidence can be acquired from this partition. iOS
performs its roles through four layers .
iOS Architecture Layers
1. Cocoa Touch Layer: The top layer of the iOS architecture, this layer
consists of a set of basic frameworks for developing the visual
interface and providing the basic infrastructure for applications on the
iOS system such as touch, multitouch, input services and processes,
and high-level tasks.
2. Media Layer: This application consists of basic multimedia
frameworks such as audio, video, and graphics.
This layer provides an aided environment for programmers to create
applications with a
distinctive graphic appearance .
3. Core Service Layer: This layer works to provide the basic services
required for applications on the system, such as location services,
communication services, and iCloud services
4. Core OS Layer: This layer is located directly above the device’s
hardware, and it deals with basic, low-level functions in the device,

as memory management, file

such

system, communication, and networking.

The HFS Plus filesystem
 Hierarchical File System (HFS), to accommodate the storage of
large datasets.
 In a HFS filesystem, the storage medium is represented as
volumes.
 HFS volumes are divided into logical blocks of 512 bytes.
 The logical blocks are numbered from first to last on a given
volume and will remain static with the same size as physical
blocks, that is, 512 bytes.
 These logical blocks are grouped together into allocation blocks,
which are used by the HFS filesystem to track data in a more
efficient way.
 HFS uses a 16-bit value to address allocation blocks, which limits
the number of allocation blocks to 65,535.
 To overcome the inefficient allocations of disk space and some of
the limitations of HFS, Apple introduced the HFS Plus filesystem.
 The HFS Plus filesystem was designed to support larger file sizes.
 HFS volumes are divided into sectors that are usually 512 bytes
in size.
 These sectors are grouped together into allocation blocks.
 The number of allocation blocks depends on the total size of the
volume.
 HFS Plus uses block addresses of 32 bits to address allocation
blocks.
 HFS Plus uses journaling by default. Journaling is the process of
logging every transaction to the disk,which helps prevent
filesystem corruption.
 The key characteristics of the HFS Plus filesystem are:
 efficient use of disk space,
 Unicode support for filenames,
 support for name forks,
 file compression,
 journaling,
 dynamic resizing,
 dynamic defragmentation, and
 an ability to boot on operating systems other than macOS.
The HFS Plus volume
The HFS Plus volume contains a number of internal structures to
manage the organization of data.
These structures include a header, an alternate header, and five
special files:
An allocation file, an extents overflow file, a catalog file, an attributes
file, and a startup file.
Among the five files, three files (the extents overflow file, the catalog
file, and the attribute file) use a B-tree structure, a data structure that
allows data to be efficiently searched,viewed, modified, or removed.
The volume structure is described as follows:
1024 bytes: This is reserved for boot load information.
Volume header:
This stores volume information, such as the size of allocation blocks, a
timestamp of when the volume was created, and metadata about each
of the five special files.
Allocation file:
This file is used to track which allocation blocks are in use by the
system. The file format consists of one bit for every allocation block. If
the bit is
set, the block is in use. If it is not set, the block is free.
Extents Overflow file:
This file records the allocation blocks that are allocated when the file
size exceeds eight blocks, which helps in locating the actual data when
referred. Bad blocks are also recorded in the file.

Catalog file:
This file contains information about the hierarchy of files and folders,
which is used to locate any file and folder within the volume.
Attribute file: This file contains inline data attribute records, fork data
attribute records, and extension attribute records.
Startup file: This file holds the information needed to assist in booting
a system that does not have HFS Plus support.
Alternate Volume header: This is a backup of the volume header,
and it is primarily used for disk repair.
512 bytes: This is reserved for use by Apple, and it is used during the
manufacturing process.