Macintosh Boot Process Fallback when Pre-linked Kernel Missing
A Computer Hacking Forensic Investigator (CHFI) is examining a compromised Macintosh computer. The system was found to be missing the pre-linked kernel at /System/Library/Caches/com.apple.kernelcaches. What is the next step that the Macintosh boot process will take to load the operating system in such a scenario?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests knowledge of Mac boot loader fallbacks; the trap is confusing the mkext cache with standard extension directories or later I/O Kit initialization steps.
This question examines the Mac OS X boot sequence failure mode when the pre-linked kernel cache is absent. The correct answer identifies the mkext cache file as the immediate fallback mechanism for loading device drivers.
Candidates often select D, assuming the system scans Extensions directly, missing the intermediate mkext cache step defined in CHFI v10 curriculum.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
When the pre-linked kernel located at /System/Library/Caches/com.apple.kernelcaches is missing, the Mac OS X boot loader (boot.efi) does not immediately scan directories. According to the CHFI v10 textbook and legacy Mac boot processes, it first attempts to load the mkext cache file. This file contains a bundled set of kernel extensions and device drivers necessary for the kernel to initialize.Why the Other Options Are Wrong
Option B describes the I/O Kit initialization which happens after drivers are loaded. Option C describes the initial handoff from firmware to the OS loader, which occurs before kernel loading logic. Option D describes the fallback if the mkext cache is also missing or invalid, but it is not the next immediate step after the pre-linked kernel fails.Community Comment Notes
The community consensus strongly supports A. As user Elb noted, "If the pre-linked kernel is missing, the boot loader attempts to load the mkext cache file." User 044f354 cited the specific CHFI v10 module page confirming this sequence. Another commenter emphasized that the mkext file contains the collection of kernel extensions needed when the primary cache is unavailable.Exam Strategy
Memorize the specific fallback order of Mac OS boot components. Do not assume modern macOS behavior applies to older CHFI questions referencing mkext caches, which were relevant in earlier versions like OS X 10.4-10.6.
Frequently Asked Questions
Why is option D incorrect if the pre-linked kernel is gone?
Option D is a secondary fallback. The system tries the mkext cache (A) first. It only searches /System/Library/Extensions if the mkext file is also missing or corrupted.
Does this apply to all Mac operating systems?
No. The mkext cache was used primarily in older Mac OS X versions (pre-10.7). Modern macOS uses different mechanisms, but CHFI v10 tests this specific legacy behavior.