Macintosh Boot Process Fallback when Pre-linked Kernel Missing

312-49v10 By islever Editorial Last updated

Linux and Mac Forensics

Short answer

A The boot loader will attempt to load the mkext cache file containing a set of device drivers.

Question

A Computer Hacking Forensic Investigator (CHFI) is examining a compromised Macintosh computer. The system was found to be missing the pre-linked kernel at /System/Library/Caches/com.apple.kernelcaches. What is the next step that the Macintosh boot process will take to load the operating system in such a scenario?
  1. The boot loader will attempt to load the mkext cache file containing a set of device drivers Correct Answer
  2. The system will initialize the I/O kit and link the loaded drivers to the kernel
  3. The boot loader will pass control to BootX (PowerPC) or boot.efi (Intel)
  4. The boot loader will search for drivers in the/System/Library/Extensions directory

Key Takeaways

Tests knowledge of Mac boot loader fallbacks; the trap is confusing the mkext cache with standard extension directories or later I/O Kit initialization steps.

This question examines the Mac OS X boot sequence failure mode when the pre-linked kernel cache is absent. The correct answer identifies the mkext cache file as the immediate fallback mechanism for loading device drivers.

Common mistake: Candidates often select D, assuming the system scans Extensions directly, missing the intermediate mkext cache step defined in CHFI v10 curriculum.

Expert Analysis

Why the Answer Is Correct

When the pre-linked kernel located at /System/Library/Caches/com.apple.kernelcaches is missing, the Mac OS X boot loader (boot.efi) does not immediately scan directories. According to the CHFI v10 textbook and legacy Mac boot processes, it first attempts to load the mkext cache file. This file contains a bundled set of kernel extensions and device drivers necessary for the kernel to initialize.

Why the Other Options Are Wrong

Option B describes the I/O Kit initialization which happens after drivers are loaded. Option C describes the initial handoff from firmware to the OS loader, which occurs before kernel loading logic. Option D describes the fallback if the mkext cache is also missing or invalid, but it is not the next immediate step after the pre-linked kernel fails.

Community Comment Notes

The community consensus strongly supports A. As user Elb noted, "If the pre-linked kernel is missing, the boot loader attempts to load the mkext cache file." User 044f354 cited the specific CHFI v10 module page confirming this sequence. Another commenter emphasized that the mkext file contains the collection of kernel extensions needed when the primary cache is unavailable.

Exam Strategy

Memorize the specific fallback order of Mac OS boot components. Do not assume modern macOS behavior applies to older CHFI questions referencing mkext caches, which were relevant in earlier versions like OS X 10.4-10.6.

Frequently Asked Questions

Why is option D incorrect if the pre-linked kernel is gone?

Option D is a secondary fallback. The system tries the mkext cache (A) first. It only searches /System/Library/Extensions if the mkext file is also missing or corrupted.

Does this apply to all Mac operating systems?

No. The mkext cache was used primarily in older Mac OS X versions (pre-10.7). Modern macOS uses different mechanisms, but CHFI v10 tests this specific legacy behavior.

More 312-49v10 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Elb 👍 2 Answered A
    ▪ The boot loader loads a pre-linked version of the kernel located at /System/Library/Caches/com.apple.kernelcaches ▪ If the pre-linked kernel is missing, the boot loader attempts to load the mkext cache file, which contains a set of device drivers ▪ If the mkext cache file is also missing, the boot loader searches for drivers in the /System/Library/Extensions directory
  2. 044f354 👍 1 Answered A
    Computer Hacking Forensic Investigator Understanding Hard Disks and File Systems Module 03 Page 236 -------------------------------------- ▪ The boot loader loads a pre-linked version of the kernel located at /System/Library/Caches/com.apple.kernelcaches ▪ If the pre-linked kernel is missing, the boot loader attempts to load the mkext cache file, which contains a set of device drivers ▪ If the mkext cache file is also missing, the boot loader searches for drivers in the /System/Library/Extensions directory -------------------------------------- (EC-Council, 2021-03-01) EC-Council. (2021-03-01). Computer Hacking Forensics Investigator (CHFI) Version 10, 10th Edition. [[VitalSource Bookshelf version]]. Retrieved from vbk://9781635676969
  3. aqeel1506 👍 1
    According to the CHFI v10 textbook, the correct step if the pre-linked kernel is missing is: A. The boot loader will attempt to load the mkext cache file containing a set of device drivers The mkext (Macintosh Kernel Extension) cache file contains a collection of kernel extensions and device drivers. If the pre-linked kernel is missing, the boot loader will attempt to use the mkext cache to load the necessary drivers to boot the system.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Analyzing Password-Protected Packed Malware

S-grade

Steganalysis for Steganography Attack Detection

S-grade

File Sector Allocation and Fragmentation in Forensics

S-grade

Which Tor Relay Should Investigators Focus On to Trace Data Origin?

S-grade

← Back to 312-49v10 Study Guide