A Computer Hacking Forensic Investigator (CHFI) is examining a compromised Macintosh computer. The system was found to be missing the pre-linked kernel at /System/Library/Caches/com.apple.kernelcaches. What is the next step that the Macintosh boot process will take to load the operating system in such a scenario?
If the pre-linked kernel is missing at /System/Library/Caches/com.apple.kernelcaches, the boot loader's next logical step is to attempt to load the mkext cache file, which contains a set of device drivers. This is the standard procedure in the Macintosh boot process to ensure the required drivers for hardware initialization are available.
▪ The boot loader loads a pre-linked version of the kernel located at /System/Library/Caches/com.apple.kernelcaches ▪ If the pre-linked kernel is missing, the boot loader attempts to load the mkext cache file, which contains a set of device drivers ▪ If the mkext cache file is also missing, the boot loader searches for drivers in the /System/Library/Extensions directory