defL

user Culde SLefano lraLepleLro, Sandro 8osseLLl k. 0,6

2

1bls mooool ls JeJlcoteJ to le ooJ 5llvlo. tbook voo fot voot loflolte potleoce.

lt's olso JeJlcoteJ to bobo ooJ loooto.we teollvbope tbot tbev wlll tesemble motetbelt motbets tboo tbelt fotbets. 3 Sommario Sommarlo ............................................................................................................................ 3 AuLhors ................................................................................................................................ 3 SofLware llcense .................................................................................................................. 6 lnLroducLlon ......................................................................................................................... 7 uLl1 Llnux llve Cu ................................................................................................................ 8 AppllcaLlons LlsL ............................................................................................................... 8 8un Lhe uLl1 Llnux llve Cu ............................................................................................. 10 uLl1 Llnux LexL mode ........................................................................................................ 12 Manaalna SLoraae Medla ............................................................................................... 12 MounLlna memorles ...................................................................................................... 13 dd / raw flle Lvpe ........................................................................................................ 13 LWl / Lncase llle ....................................................................................................... 13 All llle ...................................................................................................................... 13 Pash calculaLlon ......................................................................................................... 13 Md3sum ..................................................................................................................... 16 Sha1sum .................................................................................................................... 16 Mu3 and SPA deep .................................................................................................... 17 uhash ......................................................................................................................... 17 CapLure SLoraae Medla .................................................................................................. 17 dd .............................................................................................................................. 18 ddrescue .................................................................................................................... 18 dcfldd ......................................................................................................................... 18 uhash ......................................................................................................................... 19 CreaLlna a Llme llne ........................................................................................................ 20 lLS ............................................................................................................................. 20 macLlme ..................................................................................................................... 20 Search for flles and dlrecLorv.......................................................................................... 21 LocaLe ........................................................................................................................ 21 flnd ............................................................................................................................ 21 uLl1 Llnux Cul .................................................................................................................. 23 4 lnLroducLlon ................................................................................................................... 23 Mass SLoraae ManaaemenL ............................................................................................ 23 Pash calculaLlon ............................................................................................................. 26 AcqulslLlon of mass sLoraae ............................................................................................ 27 uhash ......................................................................................................................... 27 Cuvmaaer .................................................................................................................. 28 Search for flles and folders ............................................................................................. 30 llle Carvlna .................................................................................................................... 30 Case ManaaemenL wlLh AuLopsv .................................................................................... 31 CreaLlna a new case ................................................................................................... 32 xpllco ............................................................................................................................. 37 CreaLlna a new case ................................................................................................... 37 uLl1 LxLra ......................................................................................................................... 40 5 Authors Stefano"YoungSTEr"Fratepietrograduatedin2006inInformation TechnologyandManagement(InternetScience)attheUniversityof Bologna with a thesis in Computer Forensic entitled "A case study of the virusVierika".certificateISECOMOPSTcurrentlyisasecurityspecialist attheOfficeofITSecurityCSE(BankingAssociation).Hecarriesout activities as Digital forensic expert for tribunals, law enforcement agency andprivatecompany.Initaly,hewasinvolved,asadviser,incasesof nationalfameas"Goodmorning!Vitaminic"and"Pirelli-Telecom-Ghioni". Since2005heisthecreatorandprojectleaderoftheDEFTteam. OccasionallyperformsteachingactivitiesonComputerForensicsfor Italian universities and private courses. He's member of the IISFA (Italian Chapter) since 2008.

Sandro "bUSBoy" RossettiAlessandroRossettilivesandworksinRome.Mostofhispersonal interestsareintoInformationTechnology,focusingonsecurityand forensicissues.Heisamemberofseveralindependentorganizations suchasISACA(BoardofDirectorsoftheRomeChapter),IACISand IISFA (Italian Chapter). 6 5oftware ||cense Attr|but|on - No Der|vat|ve Works 2.5

ou are freetocopv,dlsLrlbuLe,communlcaLe Lo Lhe publlc, publlclvdlsplav, and perform Lhe work under Lhe followlna condlLlons: Attr|but|on - ?ou musL aLLrlbuLe Lhe work ln Lhe manner speclfled bv Lhe auLhor or llcensor (buL noL ln anv wav LhaL suaaesLs LhaL Lhev endorse vou or vour use of Lhe work). No Der|vat|ve Works - ?ou mav noL alLer, Lransform, or bulld upon Lhls work. Wa|ver-AnvofLheabovecondlLlonscanbewalvedlfvouaeLpermlsslonfromLhe copvrlahL holder. ubllcuomaln-WhereLheworkoranvoflLselemenLslslnLhepubllcdomalnunder appllcable law, LhaL sLaLus ls ln no wav affecLed bv Lhe llcense. Cther k|ghts - ln no wav are anv of Lhe followlna rlahLs affecLed bv Lhe llcense: ?ourfalrdeallnaorfalruserlahLs,oroLherappllcablecopvrlahLexcepLlonsand llmlLaLlons 1he AuLhors' moral rlahLs, 8lahLs oLher persons mav have elLher ln Lhe work lLself or ln how Lhe work ls used, such as publlclLv or prlvacv rlahLs. Not|ce-loranvreuseor dlsLrlbuLlon, voumusLmakeclearLooLhersLhe llcenseLermsof Lhls work. 1he besL wav Lo do Lhls ls wlLh a llnk Lo Lhls web paae.

1hlslsareadablesummarvofLhefullllcenseaLall: hLLp://creaLlvecommons.ora/llcenses/bv-nd/2.3/lL/leaalcode

7

Introduct|on We wanL Lo provlde v Lhls manual a baslc undersLandlna abouL Lhe kev feaLures of Lhe uLl1 Llve dlsLro. lLLhusrepresenLsasLarLlnapolnLfromwhlchvoucandrawlnsplraLlonandasLlmullLo arowLh vour Lechnlcal experLlse. 1hesepaaeswlllnoLprovlde(fornow)adepLhdescrlpLlonofeachappllcaLlonandhoLLo useevervcommandlncluded.WehavelncludedafewexamplesLosuaaesLvouhowLo performsomeofLhemalnacLlvlLlesofulalLallorenslcsuchasacqulslLlon,preservaLlon, analvslsandmanaaemenLofcaseslnvolvlnamasssLoraae(harddrlves,uS8sLlcks,M3 plavers) and/o Lrafflc over l neLworks.

llnallv we wlsh Lo Lhank Lhe people who handled Lhe revlew phase of Lhe manual: nC CnL!!! 1PAnk ?Cu! Pave fun! 8 DLI1 L|nux ||ve CD 4pp/icotions List DLI1 L|nux sleuLhklL 3.2.0 auLopsv 2.24 lul 0.8 dhash 2.0.1 aff llb 3.6.4 ulsk uLlllLv 2.30.1 auvmaaer 0.3.7 1.14 dd rescue dcfldd 1.3.4.1 dc3dd 7 loremosL 1.3.6 phoLorec 6.11 mounL manaaer 0.2.6 scalpel 1.60 Wlpe 00:21 hex dump ouLauess 0.2ophcrack 3.3.0 uLl1 xpllco 0.6.1 edlLlon wlreshark 1.2.11 eLLercap 0.7.3 nmap 3.21 dmrald LesLdlsk 6.11 ahex, llahL aLk hex edlLor vlneLLe 0.6 1rlu 2:02 uLl1 edlLlon readpsL 0.6.41chkrooLklLrkhunLer 1.3.4 [ohn 1.7.2 caLflsh1.0 blsculL asco 1.0 md3sum sha1sum sha224sum sha236sum sha312sum md3deep sha1deep sha236deep Skvpe loa vlew xnvlew xmounL 0.4.4 lL, Mozllla, Cpera and Chrome cache vlewer lL, Mozllla, Cpera and Chrome hlsLorv vlewer lndex.daL flle analvzer pdfcrack cracklna Lool fcrackzlp cracklna Lool Clam AnLlvlrus 4.13 mc

DLI1 Lxtra WlnAudlL 2.28.2 Ml1LC Wlndows 8ealsLrv 8ecoverv 1.3.1.0 Zerovlew 1.0 l1k lmaaer 3 nlallanL32 0.1 Wlndows lorenslc 1oolchesL 3.0.03 MoonSols Wln32dd 1.0.2.20100417 MoonSols Wln64dd 1.0.2.20100417 Wlndows llle Analvzer 1.0 ulLraSearch 1:40 re-Search xx.08 xnvlew 1.97.8 x-AaenL8ansackk 2010 (bulld 762) SmarLSnlff x86 and x64 1.71 SLarLup8un 1.22 MvLasLSearch 1:44 Mozllla Cookles vlew 1.30 Cpened llles vlew 1:46 Cpera Cache vlew 1:37 CuLlook vlew ALLack x86 and x64 1:33 rocess AcLlvlLv vlew x86 and x64 1.11 8ecenL llles vlew 1.20 8eaScanner x86, x64 and wln98 1.82 ServlWln 1:40 uS8uevlew x86 and x64 1.80 AsslsL 1.1 user vlew 9 lndex.daL Analvzer 2.3 AccessLnum 1.2 10:03 AuLoruns ulskvlew 2.4 lllemon rocess Lxplorer 12.04 1.1 8AM Map 8eamon 8ooLklL 8evealer 1.71 vMMap 2.62 WlnCb[ 2.13 AlLernaLeSLreamvlew 1.13 ChromeCachevlew 1.23 CurrorLs x86 and x64 1.83 Currrocess 1.13 lolders8eporL 1.21 lL Cache vlew 1:32 lL Cookles vlew 1.74 lL PlsLorv vlew 1:30 lnslde Cllpboard 1.11 Llve vlew ConLacLs 7.1 Mozllla Cache vlew 1.30 Mozllla PlsLorv vlew 1.23 Mozllla Cookles vlew 1.30 Cpened llles vlew 1:46 Cpera Cache vlew 1:37 CuLlook vlew ALLack x86 and x64 1:33 rocess AcLlvlLv vlew x86 and x64 1.11 8ecenL llles vlew 1.20 8eaScanner x86, x64 and wln98 1.82 ServlWln 1:40 Mul Cache vlew 1.1 MvLvenLvlew 1:37 SkvpeLoavlew 1.13 vlew user roflle 1.1 vldeo Cache vlew 1.78 WhaLlnSLarLup 1.23 WlnerfecLvlew 1.10 assword 1ool Chromeass 1.10 ulalupass 3.10 lL assvlew 1.20 uump LSA SecreLs x86 and x64 1.21 LSA SecreLs vlew 1.21 x86 and x64 Mall assvlew 1.63 Messenass 1:33 neLwork ass8ecoverv x86 and x64 1.30 Cpera assvlew 1.1 asswordlox 1.23 C Anvass 1.12 ass roLecLed vlew 1.63 S1 assword 1.12 8emoLe ueskLop assvlew 1.1 vnC assvlew 2.1 Wln9x assvlew 1.1 Wlrelesskevvlew x86 and x64 1:34 AvlScreen orLable 3.2.2.0 Poverdesk 0.8 llle 8esLore lus 3.0.1.811 WlnvnC 3.3.3.2 1reeSlzelree 2:40 C1lme L1lvlewer 3.2 Sophos AnLl-8ooLklL 1.3.4 1ermlnal wlLh command llne Lools SparLakus 1.0 1esLdlsk 6.11.3 hoLorec 6.11.3

10 kun the ul1 Linux /ive cu llrsL vou musL ensure LhaL Lhe conflauraLlon of Lhe svsLem 8lCS ls seL Lo scan booL from Cu-8CM/uvu-8CMorexLernalsLoraaedevlces(dependlnaonLhemedlumonwhlchlsuLl1 lnsLalled).CncevouseLupLhe8lCS,pleaserebooLLhesvsLemwlLhLheCu-8CMalreadv lnserLed lnLo Lhe Cu/uvu drlver or uS8 pen alreadv connecLed Lo an uS8 porL. 1he boaL loader allow vou Lo cusLomlze: Lhe defL lanauaae (bv presslna l2) 1he kevmap (bv presslna l3)

cboooloo tbe looooooe

cboooloo tbe kevbootJ's kevmop

?ou can also cusLomlze a few more sLarLup parameLers, such as: 11 acp|=offornoap|c:LhebooLdoesnoLuseAClfuncLlonsforLhepower manaaemenL, no|ap|c, dlsables Lhe AlC funcLlons for lnLel Cu-based archlLecLures, edd = on, enable Lhe Lnhanced ulsk urlve, nodmra|d, dlsable Lhe kernel seLLlna for dmrald rald Lvpe of sofLware, vga = xxx seLs Lhe framebuffer resoluLlon lf vour vldeo card ls ln vesa mode

ueprecaLedparameLersarerappresenLedlnred,lnblackLheparameLersLhaLshowedno malfuncLlon. lor more lnformaLlon abouL Lhese parameLers, please refer Lo Appendlx 1. 12 DLI1 L|nux text mode afLerLhecompuLerbooL,LhesvsLemwlllshowaLexL-basedbashshellsesslonwlLhrooL permlsslons (wlLh slx Lermlnals bv Lhe kev comblnaLlon AL1 l1 -> l6). 1hls lmplemenLaLlon lsvervusefulwhen-vouneedLosLarLuLl1LlnuxonavervoldcompuLersLhaLdonoL supporLanopLlmaluseof Lhearaphlcal lnLerface-anadvanceduserwhoprefersLowork from Lhe command llne.

ul1 lloox txt moJe

Monooino 5torooe Medio 1hefollowlnacommandsarevevusefulwhenvouneedLoperformLasksrelaLedLoLhe manaaemenL of sLoraae devlces: fJlsk-l. lL llsL of all Lhe parLlLlons and sLoraae devlces connecLed. mmls / Jev / xxx or mmls oomeflle.JJ. tbev llst Lhe parLlLlons on Lhe devlce or raw lmaae lndlcaLlna Lhe sLarLlna offseL and Lhe unallocaLed space. bJpotm-lo / Jev / xxx. lt sbows tbe Ac characLerlsLlcs of Lhe mass memorv xxx. toll-f / vot / loo / messooes. lL dlsplav messaaes ln real Llme oolloe lofotmotloo. wotoloo ooJ debua of eveots tbot be olso covet sLoraae devlces. 13 Mountino memories 1he mounL command allows vou Lo connecL a flle svsLem Lo a svsLem dlrecLorv.1he selecLed flle svsLem, blslde belna composed of a devlce can be conLalned wlLhln a flle: ln Lhe "blL sLream lmaae" formaL (raw or dd formaL) ln Lhe "Lncase" formaL, ( .ewf formaL) uslna "advanced forenslcs formaL" ( .aff flle). lnforenslcs,LhedlrecLmounLlnaofanevldenceshouldbedoneonlvwhenreallv necessarv1, ln Lhe read-onlv mode.1hls ensures LhaL Lhe evldence wlll noL be alLered durlna Lhe lnvesLlaaLlon.dd / raw f||e type1obeableLomounLfllesvsLemread-onlvmemorlesofphvslcalorraw[usLLvpea command as show ln followlna example:mooot-t tvpe -o sootce optloos mooot_polotwhere: tvpe lL ls Lhe flle Lvpe, vfaL, nLfs-3a, exL3 ... eLc., or auLo when vou do noL know Lhe Lvpe of flle svsLem sootcelLmavbeaparLlLlonsuchas/dev/hda1or/dev/sda1,orLhelmaaeofa parLlLlon such as dump.dd mooot_polotlLlsusuallvasubdlrecLorvof/medlaandlLmusLalreadvbeen creaLed, ea. wlLh: mkJlt / meJlo / folJetoome mosL commonlv used opLlons (-o): oro - read-onlv: read-onlv mounL of Lhe flleorw - read-wrlLe: mounL ln wrlLlna mode (lL wlll be use for Lhe copv) oloop - Lo mounL an lmaae flle onoaLlme - lL wlll noL chanae Lhe lasL access daLesonoexec - do noL allow flles execuLlon

1 8esL pracLlces lndlcaLe clearlv LhaL vou should nLvL8 work on Lhe orlalnal Mass sLoraae. lL's sLronalv advlce Lo work on coples. 14 ooffseL=n - whenvou mounL a dlsk lmaae, lL alves Lhe numberof bvLes Lo [umpLopolnLLoLhebealnnlnaofLheloalcalparLlLlonLomounL(daLa recoverable wlLh Lhe mmls command)

Lxamp|e 1: MounL ln 8W mode a n1lS parLlLlon on whlch run an acqulslLlon. mooot-t otfs-Jo-o tw / Jev/sJb1 / meJlo / Jest Lxamp|e 2: MounL ln read-onlv mode a n1lS parLlLlon of anlmaae of an enLlre dlsk. Lhrouah Lhe losetop command vou can assoclaLe a loop devlce Lo Lhe lmooe.JJ flle so LhaL vou can use Lhe appllcaLlons LhaL runs on devlces also on an lmaae of mass sLoraae devlce: losetop-t / Jev/loop0 / meJlo/Jlsco1/Jomp.JJ bv Lhe mmls uLlllLv vou can flnd Lhe flrsL offseL of a dlsk parLlLlon: mmls / Jev/loop0 and aeL an ouLpuL llke followlna one: uO5 lottltloo 1oble Offset 5ectot. 0 uolts ote lo 512-bvte 5ectots 5lot 5tott oJ leootb uesctlptloo 00. Meto 0000000000 0000000000 0000000001 ltlmotv 1oble (# 0) 01. ----- 0000000000 0000002047 0000002048 uoollocoteJ 02. 00.00 0000002048 00000J2255 0026624000 uokoowo 1vpe (0x27) 0J. 00.01 00000J2256 0086598247 0000204800 N1l5 (0x07) 05. ----- 0086598248 097677J167 0000002048 uoollocoteJ

WemounLLheparLlLlonldenLlfledas03fromLheouLpuLofmmlsspeclfvlnaLheoffseL mulLlplled bv 3122: mooot-t otfs to. oootlme. ooooto. ooexec. offset = 16515072 / Jev/loop0 / meJlo / Jest

leasecompleLedallLheoperaLlonsonLhememorvdevlcesbeforedlsconnecLlnaLhem from Lhe svsLem. 1o dlsconnecL a memorv vou can use Lhe umounL command:omooot / meJlo / pooto_Jl_mooot.

2 312 bvLes ls Lhe defaulL slze of a secLor ln a mass sLoraae. 15 LWI / Lncase I||e 1hemounLof.LWlmemorvcanbeobLalnbvLhemooot_ewfopp.1hlsapp,alvenoneor morespllLLedflleslnLheLncaseformaL,converLs"vlrLuallv"LWlflleslnrawformaL allowlna Lhe mounL of Lhe devlce llke a memorv acqulred ln Lhe dd formaL.

Lxamp|e: Lhe dlsk01 lmaae ls dlvlded lnLo Lhe followlna flles Jlsk01.01 Jlsk01.07 Jlsk01.1J Jlsk01.19 Jlsk01.02 Jlsk01.08 Jlsk01.14 Jlsk01.20 Jlsk01.0J Jlsk01.09 Jlsk01.15 Jlsk01.lofo Jlsk01.04 Jlsk01.10 Jlsk01.16 Jlsk01.05 Jlsk01.11 Jlsk01.17 Jlsk01.06 Jlsk01.12 Jlsk01.18

1he command mooot_ewf / meJlo / cose1/Jlsk01. * / tmp/Jlsk01 wlll reconsLrucL Lhe spllLLed lmaae and lL wlll perfom a vlrLual converslon ln Lhe raw formaL.1hlsoperaLlonwlllcreaLeLhe/tmp/Jlsk01/Jlsk01.rawfllelnLhefolder/tmp/Jlsk01/. whlch can be mounLed followlna Lhe procedure Lo mounL memorles as loop devlces. AII I||e As for Lhe LWl formaL, Lhe memorles,acqulred lnLheAll formaLcan be mounLed Lhanks LheAffosemounLuLlllLv.AffuseallowsvouLouseacqulslLlonslnLheAllformaLsasraw lmaaes.1he command svnLax ls: Affose / meJlo/Jlsk/Jlsk01.off / tmp/Jlsk01 / LheouLpuLlsLhe/tmp/Jlsk01/Jlsk01.off.towflleLhaLcanbemounLedfollowlnaLhe procedure Lo mounL Lhe loop devlce as memorv.

nash ca|cu|at|on 1hehashofablockofdaLa(eaaflle)lsasequenceofalphanumerlccharacLersofflxed lenaLhaeneraLedbvamaLhemaLlcalfuncLlon.AnvmodlflcaLlonofdaLa,Lhouahmlnlmal, wlll creaLe a compleLelv dlfferenL hash.1hlsmaLhemaLlcalfuncLlonlsmono-dlrecLlonal:lLlslmposslbleLoreconsLrucLLheblock LhaL has orlalnaLed an hash sLrlna. 1he Llnux svsLem vou can use of Lhe followlna appllcaLlons Lo aeneraLe an hash sLrlna: 16 md3sum sha1sum md3, sha1 and sha236 deep dhash Md5sum 1heMu3(MessaaeulaesLalaorlLhm3)alaorlLhmlsacrvpLoaraphlchashalaorlLhm deslanedbv8onald8lvesLln1991andsLandardlzedwlLhLhe8equesLforCommenLs8lC 1321. Mu3processesavarlable-lenaLhsLrlnalnLoaflxed-lenaLhouLpuLof128blLs(knownas "Mu3 Checksum" or "Mu3 Pash") LhaL can be used Lo compuLe Lhe dlalLal slanaLure of Lhe lnpuL.1he process ls verv fasL and lL ls hlahlv unllkelv Lo aeL a colllslon beLween Lhe ouLpuL ofLwodlfferenLlnpuLsLrlnas.Moreover,aswlLhmosLhashlnaalaorlLhms,lLshouldn'Lbe posslble, lf noL for aLLempLs (bruLe force) Lo be Lraced back Lo Lhe lnpuL sLrlna sLarLlna from LheouLpuLsLrlna(LheranaeofposslblevalueslnouLpuLlslnfacLequalLo2128eslmaLo power). Lxample: mJ5som / Jev / sJo

5ha1sum 1heSecurePashAlaorlLhm(SPA)lsoneofanumberofcrvpLoaraphlchashfuncLlons deslanedln1993bvLhenaLlonalSecurlLvAaencv(nSA)andpubllshedbvnlS1asau.S. lederal lnformaLlon rocesslna SLandard. Llke anv hash alaorlLhm, Lhe SPA produces a flxed-lenaLhmessaae dlaesL, or flnaerprlnLof Lhe messaae, from a messaae of a varlable lenaLh.1hesecurlLv of a hash alaorlLhm ls LhaLLhefuncLlon ls noL reverslble(levou can noL Lrace back Lhe orlalnal messaae knowlna onlv lLs hash lnformaLlon) and lL should noL be posslblle LocreaLe"colllslons"beLweenhash:lL'snoLposslbleobLalnLhesamehashdlaesLsLarLlna from dlfferenL flles .1hls famllv of alaorlLhms ls referred as SPA-1, SPA-224, SPA-236, SPA-384 and SPA-312. 1he lasL four varleLles ofLen referred Lo aenerlcallv as SPA-2, ln order Lo dlsLlnaulshLhemfromprevlousverslons.1heflrsLLvpeproducesamessaaedlaesLof160 17 blLsonlv,whlleoLhersproducedlaesLsoflenaLhequalLoLhenumberlndlcaLedlnLhelr leLLers (l.e. SPA-236 produces a dlaesL of 236 blLs). CurrenLlv, Lhe SPA-1 alaorlLhm ls Lhe mosL common of Lhe SPA famllv and lL's used ln manv appllcaLlons and proLocols. Lxample: sbo1som / Jev / sJo MD5 and 5nA deep Md3, sha1, sha236 and sha312 allow vou lL Lo calculaLe hashes of mulLlple fllesLxamp|e:mJ5Jeep-l / toot / evlJeoce /> bosb_Jevlce.txt 1hesvnLaxmenLlonedabovecalculaLesLhemd3hashofallfllesln/toot/evlJeoce/ dlrecLorv and saves Lhem ln Lhe hash_devlce.LxL flle. Dhash uhash,(lLallanandLnallshverslonsareavallable),allows(lnaddlLlonLoLheslmulLaneous acqulslLlon and calculaLlon of Lhe hash) Lo calculaLe onlv Lhe hash of flle and sLoraae svsLem provldlna real Llme lnformaLlon durlna Lhe calculaLlon as Lhe esLlmaLed Llme before Lhe end ofLheoperaLlonandLhesLaLusofLhecalculaLlon,LheLermcanalsoaeneraLeareporLln hLml formaL.lromlnhouseLesLswedeLermlnaLedLhaLuhashls10fasLerLhanLheoLherLoolsllsLed above. Lxamp|e: Jbosb-t-f / Jev / sJo - mJ5 - sbo1-l Jbosbloo.btml 1he svnLax above menLloned slmulLaneouslv allow vou Lo calculaLe Lhe sha1 and md3 hash of Lhe / Jev / sJo devlce and save Lhe values ln Lhe Jbosbloo.btml flle. 1he proaram ls avallable ln lLallan and Lnallsh. copture 5torooe Medio LheprocessofacqulrlnaamasssLoraaeallowsclonlnaofarealmemorvlocaLlonof acLlvlLv.lnslde Lhe Llnux svsLem Lhls ls posslble Lhrouah Lhe use of Lhe followlna Lools: dd ddrescue 18 dcfldd dhash

dd ud Lakes as lnpuL a flle or devlce and repllcaLes lLs exacL blnarv sequence on anoLher devlce of flle. Lxample: JJ lf = / Jev / sJo of = / meJlo / Jlsco.lmo1hecommandLakesas lnpuLLhemass memorvb/dev/sdaandreLurnsasouLpuLlnhls clone dlsco.lma flle ln Lhe / medla / folder. voucanuselLLocloneamemorvdevlcenoLonlvfromamasssLoraaeflle(orvlceversa) and also from mass sLoraae Lo mass sLoraae. Lxample: JJ lf = / Jev / sJo of = / Jev / sJb

ddrescue Llkedd,ddrescuecancloneLhememorvconLenLsofadlskdlrecLlvLoanoLhermemorv supporL. ddrescue lsanevoluLlonofdd:unllkeddlLwlllconLlnuereadlnaLhefollowlnasecLor, lf lL flnds bad secLors lL cannoL read. 1hose bad secLors wlll be acqulred bv seLLlna Lo zero all Lhe unreadableblLs.uurlnaLheacqulslLlonprocessddrescueprovldedupdaLesonhowmanv read and wrlLLen bvLes, how manv errors have been found and Lhe capLure raLe calculaLed for bvLes / s. Lxample: JJtescoe / Jev / sJo / meJlo / Jlsco.lmo

dcf|dd dcfldd ls an enhanced verslon of oLher dd Lools and lL can be used Lo calculaLe hash (md3 or sha1LhaL,lndlvlduallvorLoaeLher)durlnaLheacqulslLlonofmemorv.uurlnaLhe 19 acqulslLlonsprocess lL alsowlll provlde deLallson how much daLa has been haveread and wrlLLen. Lxample: JcflJJ lf = / Jev / sJo of = / meJlo / Jlsco.lmo bosb = sbo1 bosb = mJ5

Dhash 1hlssofLwareallowsvouLoacqulrelnLheddformaLand,lnLhesameLlme,Lhehash calculaLlon. lL's ls 10 fasLer Lhan oLher Lools avallable. Lxamp|e:Jbosb-t-f / Jev / sJo - mJ5 - sbo1-o Jlsco.JJ 1he aforemenLloned svnLax allow vou Lo capLure and slmulLaneouslv calculaLe Lhe sha1 and md3 hash of Lhe / Jev / sJo devlce and save Lhe resulL ln Lhe dhashloa.hLml loa flle. 20 creotino o time /ine Cne of Lhe mosL popular Lools for creaLlna Llme llne ls moc-tlme. parL of Lhe SleuLh klL sulLe creaLed and malnLalned bv 8rlan Carrler. Moc-tlmecancreaLesanASCllLlmellneofflleacLlvlLvbasedonLheouLpuLofLheflsLool LhaL conslsL on a llsL of Lhe flles and dlrecLorv names of a flle svsLem. fls ls able Lo process Lhe conLenLs of a alven flle svsLem or dlrecLorv and and reLurns a llsL of all flles, allocaLed/noL allocaLed, LhaL can be used laLer ln mac-Llme Lool. IL5 1he followlna example show how Lo use fls and mac-Llme Lools.fls-z CM1-s 0-m 'c.'-f otfs-t / coso1/lmooe-1.JJ> / coso1/llst-lmooe1 Lhe -zopLlonspeclfvLheLlme zone, -stbe Jlffeteoce,ln seconds,beLween Lhe svsLem Llme andLheLherealtlme.-mshowLhebealnnlnaofeachpaLhofeachflleandfolderpotb.-f lndlcaLes Lhe Lvpe of flle svsLem LhaL wlll be anallzed, / coso1/lmooe-1.JJ ls Lhe lmaae LhaL ls alven as lnpuL and and / coso1/llst-lmooe1 Lhe flle LhaL wlll conLaln Lhe llsL of Lhe flles. mact|me moctlme-b / z-coso1/llst-lmooe omt-J> / coso1/tlmelloe.csv Lhe-bopLlonlndlcaLesLheflleLoanalvze,-zLheLlmezoneand-d>/caso1/Llmellne.csv lndlcaLe Lhe name of Lhe Llme llne ln Lhe csv formaL3.1hefollowlnaLablelsusefulLoundersLandLhemeanlnaofLhevaluesLhaLappearlnLhe column"AcLlvlLv1vpe".1hevlndlcaLeLheacLlonperformedonfllesandfolderslnaalven perlod of Llme.

I||e system:M=AC8 (I1A) Lxt2 / 3ChanaedAccessedCreaLedn / a IA1WrlLlnaAccessedn / aCreaLed N1I5ChanaedAccessedMl14 modlfledCreaLed

3 lL ls preferable Lo exporL ln csv formaL for easler reference work bv appllcaLlons llke CpenCfflce or Lxcel. 4 MasLer llle 1able 21 UI5ChanaedAccessedCreaLedn / a 5eorch for fi/es ond directory lL's posslblle Lo search for flles and dlrecLorv uslna one of Lhe followlna Lools: locaLe flnd Locate LheLocaLeLoolallowsvouLosearchforflleslnamasssLoraae.8uLlnLheflrsLplacevou musL lndex all Lhe flle uslna Lhe opJoteJb commooJ. Lhls command locote floooce -o-l Lhe-l)opLlonallowsvouLorunasearchforfllesLhaLconLalnLhewordflnancewlLhouL conslderlnacaplLallzaLlon.Lhe-oopLlonwlllreporLaccesserrorsLospeclflcsvsLem dlrecLorles and wlll lndlcaLes Lhe reasons (ea "access denled"). examp|e: locote "*. poo"-o lL wlll search for all Lhe pna flle. f|nd llnd allows vou Lo search for flles wlLhouL a prlor lndexlna.examp|e: floJ. lwboleoome-"* poto *. poo" Lhe Lool wlll flnd all nC flles whlch conLaln Lhe sLrlna name ln porn wlLhouL dlscrlmlnaLlon case. examp|e: floJ. -ctlme -2> llsto.txt Lhe Lool wlll flnd all flles creaLed ln Lhe lasL 2 davs and lL wlll save Lhe llsL ln Lhe llsto.txt flle.

I||e Carv|ng 22 1hecarvlnaprocesslsLhepracLlceLosearchfllesbasedonlLsconLenL,LhrouahLhe recoanlLlon of header and fooLer, raLher lLs meLadaLa3. lL'squlLealonaprocessbecauseLhedlsklsanalvzedfromflrsLLoLhelasLblL. meLaphorlcallv speaklna, wecan compare Lhe readlna process ofLhe mass memorv Lo Lhe process of readlna a Lape drlve.

Ioremost 1he loremosL proaram can recover deleLed flles dlrecLlv from Lhe sLoraae devlces, or preferablv, from Lhe "blL sLream lmaae" flles. 1he command fotemost-o ootpJlt Jomp.lmo wlllsLarLLhecarvlnaprocessonJomp.lmofllebasedonLhe/etc/fotemost.coof conflauraLlon seL and save Lhe exLracLed flles ln Lhe ootpJlt dlrecLorv. 1he command fotemost-t jpeo-o ootpJlt Jomp.lmo wlll run Lhe carvlna process of all Lhe poo flles on Lhe Jomp.lmo flle and save Lhe exLracLed flles ln Lhe ootpJlt folder.

1he -t opLlon wlll allow Lhe user Lo reLrleve Lhe followlna Lvpes of flles:

[pa alf pna bmp avl exe

mpa Wave rlff wmv mov ul

ole doc zlp rar hLm cpp

5 Peader and fooLer are slanaLures LhaL characLerlze Lhe bealnnlna and end of anv alven flle Lvpe: Lhev are a aroup of consecuLlve hexadeclmal or ocLal values alwavs presenL ln a cerLaln poslLlon aL Lhe bealnnlna or Lhe end of Lhe flle. 23 DLI1 L|nux GUI lntroduction 1heuLl1LlnuxCullsbasedonLheLxuL"deskLopenvlronmenL"6(LlahLwelahLx11 ueskLop LnvlronmenL).We choose Lhe LxuL deskLopmanaaer for lLs feaLures and because ls one of Lhe llahLesL llnux araphlcal lnLerfaces. vouhave Lo run Lo Lhe uLl1Llnuxaraphlcal mode lf vou need Louse proarams llke ulalLal lorenslc lramework (lul) or CaLflsh. Slnce verslon 6, MlcrosofL Wlndows naLlve appllcaLlons, wlLhouL anv equlvalenL ln Lhe Llnux world, have been lnLearaLed dlrecLlv ln Lhe uLl1 svsLem uslna Wlne7. 1o sLarL Lhe Cul uLl1 Llnux slmplv Lvpe Lhe Jeft-ool. ul1 lloox uesktop

6 hLLp://www.lxde.ora 7 hLLp://www.wlnehq.ora/ 24 Cn Lhe deskLop vou can flnd Lhe followlna elemenLs: 1.AppllcaLlon Menu 2.llle manaaer 3.MounL manaaer 4.roaram for Laklna screenshoLs3.Show Lhe deskLop 6.Audlo ManaaemenL 7.neLwork ManaaemenL 8.SvsLem Llme 9.ManaaerLosuspend,loaouL, resLarL and shuLdown 10. AuLopsvevlJeoceandJltectotles usedbvoLherappllcaLlonsLo savefllesoflnLeresLsLaLemenLs submlLLed Lo analvsls 11. uLlllLvLoconflaureLhesvsLem Llme references 12. Console

More speclflcallv, ln Lhe AppllcaLlons menu vou can flnd:

ul1 lloox meoo

Accessor|es:lllemanaaer,CalculaLor,lmaaevlewer,Lx1ermlnal,ManaaeprlnL[obs, xarchlver. D|sk Iorens|cs: AuLopsv, CaLflsh, Chrome Cache vlew, ull, uhash 2, ulsk uLlllLv, Cuvmaaer, Pb4mosL,PexedlLor,vlewlLcache,lLcooklesvlew,vlewlLhlsLorv,lndex.daLanalvzer, MounLanaaer, Mozllla Cache vlew, Mozllla hlsLorv vlew, Cpera cache vlew, Cphcrack, SclLe LexL edlLor, Skvpe loa vlew, 1ake screenshoL, vlrus scanner, W88, xnvlew. Iorens|c Network: llrefox, Wlreshark, kp||co. 5ound & V|deo: ueskLop recorder, xfburn. 5ystem 1oo|s: hLop, SvsLem rofller, 1ask manaaer. references:AddlLlonaldrlvers,lookCusLomlze,ueskLopsesslonseLLlna,ulskuLlllLv, kevboardandmouse,lanauaaesupporL,monlLorseLLlnas,CpenboxconflauraLlon, 25 referredAppllcaLlons,rlnLlna,SvnapLlcackaaeManaaer,1lmeanddaLe,userand aroups, Wlndows wlreless drlvers. Moss 5torooe Monooement 1hemanaalnasLoraaedevlcespollcleslnLlnuxuLl1aulmodearealmosLldenLlcalLoLhe command llne verslon. ln deLall: 8vdefaulL,LhesvsLemdoesnoLperformanvacLlonbuLLhedeLecLlonofdevlces connecLed Lo Lhe svsLem. lfvouuseLhefllemanaaer,allsLoraaedevlces,lnLernalandexLernal,wlllbe mounLed ln 8W (read wrlLe) mode. 1heMounLManaaerappllcaLlonallowsLheoperaLorLocusLomlzeLhedevlce mounL pollcles.

Mooot lo kw moJe osloo lxJe flle mooooet

26

Mount manager MounL Manaaer allows vou Lo LranslaLe cllcks Lo advanced mounL pollcles. 1he followlna procedure show how Lo mounL a mass memorv ln 8C (read onlv) mode avold anv acLlon LhaL would alLer Lhe flle svsLem.

Mooot lollcv to ovolJ moJlflcotloo to tbe flle svstem

ln deLall, Lo mounL a devlce vou need Lo assoclaLe an exlsLlna dlrecLorv Lo a parLlLlon of Lhe memorv and ensure LhaL vou have conflaured Lhe noaLlme, noauLo, ro, noexec parameLers Lo avold memorv alLeraLlon of Lhe mass sLoraae durlna use. Cnlv ln Lhls wav vou can access Lhe flle svsLem ln read-onlv mode and work wlLhouL updaLlna Lhe access Llme lnode8. MounLManaaeralsoallowvouLomounLacqulslLlonslnLheformaL.uuandneLworkfllesvsLems such as Samba (Wlndows shares) and nlS. nosh co/cu/otion uhash ls Lhe onlv Llnux uLl1 araphlc Lool for hashlna.

8 1lmesLamp of lasL access Lo a flle svsLem's flle 27 colcolotloo of tbe bosb of o Jevlce bv ubosb Cnce vou Lhe proaram sLarLs, cllck "open devlce" Lo selecL a sLoraae devlce or "open flle" Lo selecL a flle, check Lo calculaLe Lhe hash (md3, sha1 or boLh) and cllck on "sLarLs" .Cnce vou are flnlshed vou can save a hLml reporL conLalnlna Lhe resulLs bv cllcklna on "save loa". 4couisition of moss storooe As alreadv lndlcaLed, uLl1 Llnux can acqulre mass sLoraae devlces, vla a araphlcal lnLerface, uslna uhash or Cuvmaaer.1 he flrsL one ls sulLable for acqulslLlons ln Lhe uu formaL, whlle Lhe second one ls sLronalv recommended for parallel acqulslLlon and ln Lhe ewf formaL. Dhash ln uhash, Lhe procedure for Lhe acqulslLlon ls slmllar Lo Lhe hash calculaLlon. SelecLLhedevlceLhaLvouwanLLoacqulrebvcllcklnaon"opendevlce"andselecLlna "Acqulre".?ou can capLure and compress vour LaraeL ln Lhe az formaL bv checklna Lhe box "Compress" and / or perform Lhe hash check. 28 Acoolsltloo of moss memotv wltb o potollel mJ5 sbo1 bosb cootempototv colcolotloo

bv presslna Lhe "SLarLs" sLarLs Lhe acqulslLlon.AL Lhe end of Lhe Lask, vou can save a reporL ln Lhe hLml formaL bv cllcklna Lhe "Save loa". Guymager unllke uhash, Cuvmaaer allows a more advanced acqulslLlon procedure.

Covmooet's ocoolsltloo pbose. tbe cose mooooemeot wloJowCuvmaaerallowsvouLheslmulLaneousacqulslLlonofmulLlplemasssLoraaedevlcesand Lhe manaaemenL of lnformaLlons as: Case number. Lvldence number. Lxamlner's name. uescrlpLlon of Lhe devlce vou are capLurlna. 29 CuvmaaersupporLsallma[orformaLsofacqulslLlon(dd,encaseandaff)andallowLo perform Lhe lnLearlLv check, Lhrouah verlflcaLlon of md3 or sha236, of boLh Lhe lmaae and Lhe orlalnal devlce. 1osLarLLheacqulslLlonprocess, launchLheproaram,rlahLcllckonLhemassmemorv LhaL vou wanL Lo clone and selecL "Acoolte lmooe". 1he wlndow "Acoolte lmooe" allows vou Lo seL several opLlons of Lhe acqulslLlon and Lhe manaaemenL phases of Lhe case.

30 5eorch for fi/es ond fo/ders cotflsb allow vou Lo perform Lhe same Lasks vou can do bv "command llne" uslna floJ and locote. lnLhlsexample,onceselecLedLhepaLh,welaunchasearchfor1x1fllesbvLvplnalnLhe searchfleld:*.txt.whenLhesearchlscompleLe,voucanopenLheflleslnLhellsLwlLha slmple double cllck. lloJloo flles wltb cotflsb

ln Lhe wlndow wlll be lndlcaLed even more lnformaLlon on Lhe flles: lasL modlflcaLlon daLe, flle locaLlon and slze.

li/e corvino 4mosLhunchbacked,avallablelnlLallanandLnallshlanauaae,lsaaraphlcallnLerfacefor manaalna Lhe maln feaLure of foremosL. wlLh P4M vou can carvlna for flles wlLh a few cllcks. 31 cotvloo flle wltb noocbbockeJ 4most

P4M, once selecLed flles or devlces Lo search and Lhe folder Lo save recovered flles, search for and save all flles wlLh Lhe header and fooLer seL bv Lhe operaLor.lnaddlLlonLoLradlLlonalflleformaLssupporLedbvloremosL,voucancusLomlzevour searchbvlndlcaLlnaLhepaLhofLheconflauraLlonflleconLalnlnaLhenewheadersand fooLers.

cose Monooement with 4utopsy 1heAuLopsvlorenslc8rowserlsaaraphlcallnLerfaceLoLhecommandllnedlalLal lnvesLlaaLlon Lools ln 1he SleuLh klL9. lL ls malnlv used for handllna cases requlrlna Lhe analvsls of mass sLoraae.AuLopsv allows vou Lo: dlrecLlv use Lhe devlce or acqulslLlons ln Lhe formaL dd, aff and encase, vlew flle svsLem's lnformaLlon, Analvze and ldenLlfv Lhe conLenLs of flles and dlrecLorles and Lhelr Llme references, 8ecover deleLed flles, Manaae a hash flle daLabase reaardlna Lhe Lhe case,

9 hLLp://www.sleuLhklL.ora/ 32 CreaLe and parse Lhe Llmellne, Searches for flles bv kevword, Analvze meLa daLa, CreaLe reporLs of Lhe found evldences. Creat|ng a new case CllckonLheLheAuLopsvlconlnLhelorenslculskfolder(sLarLmenu).Lheproaramwlll requesL Lo creaLe a new case or open an exlsLlna one.ln Lhls example we wlll cllck on "oew" Lo creaLe our LesL case and flllallLhedaLa fleld, l.e. Lhe case name, descrlpLlon of Lhe case and Lhe lnvesLlaaLor names: cteotloo oew cose

CncevouconflrmedallLhelnserLeddaLadeLalls,vouwlllbeableLocreaLea"case" dlrecLorv conLalnlna all Lhe deLalls ln Lhe paLh / toot / evlJeoce / cose . voucan addone ormoreob[ecLs(or acLors porLravlna members or compuLersvsLems) bv cllcklna on "add hosL" ln Lhe case and enLer Lhe requlred daLa: 33 AJJloo cose's nosts

1o everv hosL vou can be add one or more dlsk lmaae. !usL cllck on "AJJ lmooe llle" and flll Lhe"locotloo"boxwlLhLhedlrecLconnecLlonLoasLoraaedevlce(llke/Jev/sJx)orLhe paLh of Lhe flle conLalnlna Lhe acqulslLlon (such as / meJlo/foteoslc/Jlsco001.JJ). ?ou musL speclfvwheLherLhememorvvou'readdlnalsaparLlLlonorLheenLlremasssLoraae. 8eaardlnaLhelmporLmeLhod,foreaseofuse,lLlssLronalvadvlsedLoleaveLhedefaulL lmporL meLhod, (svmllnk). AJJloo lmooes

34 afLervouaddedmemorv'slmaae,AuLopsvwlllaskLocheckLhedaLalnLearlLvcalculaLlna LheMu3hashorlfvoualreadvdldlL,LomanuallvlmporLLhevalueofLhehashmd310. AuLopsv wlll requesL Lo flle Lhe mounL polnL of Lhe parLlLlon and lLs flle svsLem Lvpe.

Mooooloo bost's JetollsAfLer vou flnlsh all Lhe prevlous operaLlons, Lhe creaLlon of ulsco001 ob[ecL ls compleLe and vou can conLlnue and add more lmaaes or ob[ecL or vou can sLarL Lhe analvsls bv cllcklna on "Analvze" buLLon.

10 AuLopsv supporLs onlv Lhe Mu3 hash alaorlLhm. 35

Mooooloo tbe "ulsco001" bost

1heanalvslsmodulelnLerfaceallowsvouLovlewLheparLlLlon'sdlrecLorvLreeunder anallsvs. When vou selecL a flle, lL wlll dlsplavs a prevlew of Lhe conLenL.1heaccessLoLheflleslsread-onlvmodeLonoLalLerLhelrsreferencesLoLlmeandlLs meLadaLa.ln Lhe analvsls screen vou can see: 1he flle name/ dlrecLorv and lLs paLh 1heLlmevaluesasCreaLed1lme,Chanaed1lme/WrlLLen1lmeandModlfled 1lme 1he llle/dlrecLorv Lvpe noL allocaLed (brlahL red) or noL accuraLed reference (darker red) flle/dlrecLorv or (. 36 llle ooolvsls lo Aotopsv

AnlnLeresLlnafeaLurelsLhekevwordsearch.1hlsfeaLureallowsvouLosearchuslnaLhe otep command and covers Lhe enLlre flle svsLem Lree, lncludlna Lhe unallocaLed space.1hls operaLlon mav be verv slow when vou search sLrlnas on dlsks/lmaaes conLalnlna manv flles or larae amouL memorv.ln Lhese cases we suaaesL vou Lo open a svsLem shell and perform vour search uslna Lhe arep command llne. 1he same recommendaLlon applles Lo Lhe creaLlon of Llmellne reporLs. kevwotJ seotcb 37 xp/ico uLl1 has alwavs supporLed Lhe xpllco pro[ecL's evoluLlon slnce Lhe earllesL releases11. xpllco ls verv easv Lo use: lf a pcap alle ls alven as lnpuL12, Lhe proaram ls able Lo reconsLrucL LheconLenLsofLheallLhedaLasenLlnLhaLmomenLlnLhelneLworkandmaklnaLhem avallable and accesslble Lhrouah a frlendlv web lnLerface. kpllco loolo Creat|ng a new case ?oucanrunxpllcofromLhelorenslcSecLlonofLhe neLwork menu lnLhe sLarLmenuand uslna Lhee followlna credenLlals Lo aaln access Lo Lhe operaLor lf:

user: xpllco password: xpllco

1heseareLhedefaulLusercredenLlals.WlLhLhemvoucancreaLeandmanaaeLhecases buL vou can'L chanae anv seLLlnas.lf vou wanL Lo cusLomlze Lhe conLrol panel seLLlnas, creaLe new users, eLc., vou musL loaln wlLh admlnlsLraLor credenLlals:

user: admlnpassword: xpllco

11 1he Lool, avallable aL Lhls address hLLp://www.xpllco.ora/ , ls rlahL now one of Lhe mosL powerful open source neLwork lorenslc 1ool. 12 1hls flle conLalns daLa packeLs capLured bv a "packeL snlfflna" proaram.usuallv 1hev are packaaes LhaL were realsLered whlle LransmlLLed over a neLwork. 38 ln Lhe followlna example, we creaLed a new case ( "lppo" ) and we acqulred and analvzed allLrafflcLransmlLLedbvLhelnLerfaceeLh0ofourworksLaLlonlnLhaLmomenLlnLhaL speclflc ranae of Llme. kpllco cose mooooet

AL Lhe end of acqulslLlon phase, xpllco have alreadv decode and reconsLrucL all supporLed daLa Lvpe, as:

P11 unSweb mall smLpC3lMAslp 1elneL -fLpLfLprLp!Lfacebook chaL MSn lrc

39 uoto kepott

ln Lhe prevlous example, we vlslLed Lhe "hLLp://www.llbero.lL" slLe requesLed bv Lhe user. lrom Lhe secLlon "slLe" of Lhe "web" menu vou can access Lo 1he llsL of all Lhe reconsLrucLed Web slLes and all Lhe oLher LransmlLLed daLa. llst of oll oet execoteJ bv tbe btowset

voushouldconslderLhaLLhellsLofallaeL13alsolncludeLhoseLhaLLheuserlnvolunLarv performs: l.e. all requesLs from Lhe web paae Lo Lhe dlfferenL klnd of adverLlslna servlce or Lracklna scrlpLs.

13 requesL Lo a web server Lo dlsplav a speclflc url 40 DLI1 Lxtra ul1 xtto 5vs lofo

uLl1 LxLra ls a araphlcal lnLerface for MlcrosofL Wlndows CS famllv. lL's based on Lhe pre-lnsLalled.nL1lramework,whlchallowsLheexecuLlonofseveraldlalLalforenslcproarams (andLhelrdescrlpLlonsandpoLenLlaluses)durlnaLheLrlaaeandLhepreanalvslsofa suspecLcompuLersvsLem.LvervLlmevourunLheCul,lLwlllasksvouwhereLosaveLhe acLlvlLles reporL ( a LxL flle). lf vou cancel Lhls requesL, uLl1 LxLra wlll noL keep Lrack of anv operaLlon carrled ouL. uLl1 LxLra, and all lLs Lools MA? alLer Lhe svsLem under LesL: Wlndows realsLrv kevs wlll sLore Lhe launch of uLl1 LxLra auLorun (lf enabled), lasL accessed LlmesLamp of analvzed flles, runnlna uLl1-LxLra-3.0.exe process, lf Lhe user decldes Lo save Lhe reporL wlLhln Lhe mass sLoraae svsLem (and noL onanexLernalsupporL)parLofLhefreespaceofLheunallocaLeddaLawlllbe overwrlLLen.

lormoredeLallsoneachLool,pleasereferLoLheauldeswrlLLenbvLhelrrespecLlve developers. 41 APPENDICE 1 parametri per il boot del Kernel Kernel Parameters 2~~~~~~~~~~~~~~~~~ 3 4The following is a consolidated list of the kernel parameters as implemented 5(mostly) by the __setup() macro and sorted into English Dictionary order 6(defined as ignoring all punctuation and sorting digits before letters in a 7case insensitive manner), and with descriptions where known. 8 9Module parameters for loadable modules are specified only as the 10parameter name with optional '=' and value as appropriate, such as: 11 12modprobe USBcore blinkenlights=1 13 14Module parameters for modules that are built into the kernel image 15are specified on the kernel command line with the module name plus 16'.' plus parameter name, with '=' and value if appropriate, such as: 17 18USBcore.blinkenlights=1 19 20Hyphens (dashes) and underscores are equivalent in parameter names, so 21log_buf_len=1M print-fatal-signals=1 22can also be entered as 23log-buf-len=1M print_fatal_signals=1 24 25 26This document may not be entirely up to date and comprehensive. The command 27"modinfo -p ${modulename}" shows a current list of all parameters of a loadable 28module. Loadable modules, after being loaded into the running kernel, also 29reveal their parameters in /sys/module/${modulename}/parameters/. Some of these 30parameters may be changed at runtime by the command 31"echo -n ${value} > /sys/module/${modulename}/parameters/${parm}". 32 33The parameters listed below are only valid if certain kernel build options were 34enabled and if respective hardware is present. The text in square brackets at 35the beginning of each description states the restrictions within which a 36parameter is applicable: 37 38ACPIACPI support is enabled. 39AGPAGP (Accelerated Graphics Port) is enabled. 40ALSAALSA sound support is enabled. 42 41APICAPIC support is enabled. 42APMAdvanced Power Management support is enabled. 43AVR32AVR32 architecture is enabled. 44AX25Appropriate AX.25 support is enabled. 45BLACKFIN Blackfin architecture is enabled. 46DRMDirect Rendering Management support is enabled. 47EDDBIOS Enhanced Disk Drive Services (EDD) is enabled 48EFIEFI Partitioning (GPT) is enabled 49EIDEEIDE/ATAPI support is enabled. 50FBThe frame buffer device is enabled. 51GCOV GCOV profiling is enabled. 52HWAppropriate hardware is enabled. 53IA-64IA-64 architecture is enabled. 54IMA Integrity measurement architecture is enabled. 55IOSCHEDMore than one I/O scheduler is enabled. 56IP_PNPIP DHCP, BOOTP, or RARP is enabled. 57IPV6IPv6 support is enabled. 58ISAPNPISA PnP code is enabled. 59ISDNAppropriate ISDN support is enabled. 60JOYAppropriate joystick support is enabled. 61KGDB Kernel debugger support is enabled. 62KVMKernel Virtual Machine support is enabled. 63LIBATALibata driver is enabled 64LPPrinter support is enabled. 65LOOPLoopback device support is enabled. 66M68kM68k architecture is enabled. 67These options have more detailed description inside of 68Documentation/m68k/kernel-options.txt. 69MCAMCA bus support is enabled. 70MDAMDA console support is enabled. 71MOUSEAppropriate mouse support is enabled. 72MSIMessage Signaled Interrupts (PCI). 73MTDMTD (Memory Technology Device) support is enabled. 74NETAppropriate network support is enabled. 75NUMANUMA support is enabled. 76GENERIC_TIME The generic timeofday code is enabled. 77NFSAppropriate NFS support is enabled. 78OSSOSS sound support is enabled. 79PV_OPSA paravirtualized kernel is enabled. 80PARIDEThe ParIDE (parallel port IDE) subsystem is enabled. 81PARISCThe PA-RISC architecture is enabled. 82PCIPCI bus support is enabled. 83PCIEPCI Express support is enabled. 84PCMCIAThe PCMCIA subsystem is enabled. 85PNPPlug & Play support is enabled. 86PPCPowerPC architecture is enabled. 87PPTParallel port support is enabled. 88PS2Appropriate PS/2 support is enabled. 43 89RAMRAM disk support is enabled. 90S390S390 architecture is enabled. 91SCSIAppropriate SCSI support is enabled. 92A lot of drivers has their options described inside of 93Documentation/scsi/. 94SECURITY Different security models are enabled. 95SELINUX SELinux support is enabled. 96SERIALSerial support is enabled. 97SHSuperH architecture is enabled. 98SMPThe kernel is an SMP kernel. 99SPARCSparc architecture is enabled. 100SWSUSPSoftware suspend (hibernation) is enabled. 101SUSPENDSystem suspend states are enabled. 102FTRACEFunction tracing enabled. 103TPMTPM drivers are enabled. 104TSAppropriate touchscreen support is enabled. 105UMSUSB Mass Storage support is enabled. 106USBUSB support is enabled. 107USBHIDUSB Human Interface Device support is enabled. 108V4LVideo For Linux support is enabled. 109VGAThe VGA console has been enabled. 110VTVirtual terminal support is enabled. 111WDTWatchdog support is enabled. 112XTIBM PC/XT MFM hard disk support is enabled. 113X86-32X86-32, aka i386 architecture is enabled. 114X86-64X86-64 architecture is enabled. 115More X86-64 boot options can be found in 116Documentation/x86/x86_64/boot-options.txt . 117X86Either 32bit or 64bit x86 (same as X86-32+X86-64) 118 119In addition, the following text indicates that the option: 120 121BUGS=Relates to possible processor bugs on the said processor. 122KNLIs a kernel start-up parameter. 123BOOT Is a boot loader parameter. 124 125Parameters denoted with BOOT are actually interpreted by the boot 126loader, and have no meaning to the kernel directly. 127Do not modify the syntax of boot loader parameters without extreme 128need or coordination with . 129 130There are also arch-specific kernel-parameters not documented here. 131See for example . 132 133Note that ALL kernel parameters listed below are CASE SENSITIVE, and that 134a trailing = on the name of any parameter states that that parameter will 44 135be entered as an environment variable, whereas its absence indicates that 136it will appear as a kernel argument readable via /proc/cmdline by programs 137running once the system is up. 138 139The number of kernel parameters is not limited, but the length of the 140complete command line (parameters including spaces etc.) is limited to 141a fixed number of characters. This limit depends on the architecture 142and is between 256 and 4096 characters. It is defined in the file 143./include/asm/setup.h as COMMAND_LINE_SIZE. 144 145 146acpi=[HW,ACPI,X86] 147Advanced Configuration and Power Interface 148Format: { force | off | strict | noirq | rsdt } 149force -- enable ACPI if default was off 150off -- disable ACPI if default was on 151noirq -- do not use ACPI for IRQ routing 152strict -- Be less tolerant of platforms that are not 153strictly ACPI specification compliant. 154rsdt -- prefer RSDT over (default) XSDT 155copy_dsdt -- copy DSDT to memory 156 157See also Documentation/power/pm.txt, pci=noacpi 158 159acpi_apic_instance=[ACPI, IOAPIC] 160Format: 1612: use 2nd APIC table, if available 1621,0: use 1st APIC table 163default: 0 164 165acpi_backlight=[HW,ACPI] 166acpi_backlight=vendor 167acpi_backlight=video 168If set to vendor, prefer vendor specific driver 169(e.g. thinkpad_acpi, sony_acpi, etc.) instead 170of the ACPI video.ko driver. 171 172acpi.debug_layer=[HW,ACPI,ACPI_DEBUG] 173acpi.debug_level=[HW,ACPI,ACPI_DEBUG] 174Format: 175CONFIG_ACPI_DEBUG must be enabled to produce any ACPI 176debug output.Bits in debug_layer correspond to a 177_COMPONENT in an ACPI source file, e.g., 178#define _COMPONENT ACPI_PCI_COMPONENT 179Bits in debug_level correspond to a level in 180ACPI_DEBUG_PRINT statements, e.g., 45 181ACPI_DEBUG_PRINT((ACPI_DB_INFO, ... 182The debug_level mask defaults to "info".See 183Documentation/acpi/debug.txt for more information about 184debug layers and levels. 185 186Enable processor driver info messages: 187acpi.debug_layer=0x20000000 188Enable PCI/PCI interrupt routing info messages: 189acpi.debug_layer=0x400000 190Enable AML "Debug" output, i.e., stores to the Debug 191object while interpreting AML: 192acpi.debug_layer=0xffffffff acpi.debug_level=0x2 193Enable all messages related to ACPI hardware: 194acpi.debug_layer=0x2 acpi.debug_level=0xffffffff 195 196Some values produce so much output that the system is 197unusable.The "log_buf_len" parameter may be useful 198if you need to capture more output. 199 200acpi_display_output=[HW,ACPI] 201acpi_display_output=vendor 202acpi_display_output=video 203See above. 204 205acpi_irq_balance [HW,ACPI] 206ACPI will balance active IRQs 207default in APIC mode 208 209acpi_irq_nobalance [HW,ACPI] 210ACPI will not move active IRQs (default) 211default in PIC mode 212 213acpi_irq_isa=[HW,ACPI] If irq_balance, mark listed IRQs used by ISA 214Format: ,... 215 216acpi_irq_pci=[HW,ACPI] If irq_balance, clear listed IRQs for 217use by PCI 218Format: ,... 219 220acpi_no_auto_ssdt[HW,ACPI] Disable automatic loading of SSDT 221 222acpi_os_name=[HW,ACPI] Tell ACPI BIOS the name of the OS 223Format: To spoof as Windows 98: ="Microsoft Windows" 46 224 225acpi_osi=[HW,ACPI] Modify list of supported OS interface strings 226acpi_osi="string1"# add string1 -- only one string 227acpi_osi="!string2"# remove built-in string2 228acpi_osi=# disable all strings 229 230acpi_pm_good [X86] 231Override the pmtimer bug detection: force the kernel 232to assume that this machine's pmtimer latches its value 233and always returns good values. 234 235acpi_sci=[HW,ACPI] ACPI System Control Interrupt trigger mode 236Format: { level | edge | high | low } 237 238acpi_serialize[HW,ACPI] force serialization of AML methods 239 240acpi_skip_timer_override [HW,ACPI] 241Recognize and ignore IRQ0/pin2 Interrupt Override. 242For broken nForce2 BIOS resulting in XT-PIC timer. 243 244acpi_sleep=[HW,ACPI] Sleep options 245Format: { s3_bios, s3_mode, s3_beep, s4_nohwsig, 246old_ordering, s4_nonvs, sci_force_enable } 247See Documentation/power/video.txt for information on 248s3_bios and s3_mode. 249s3_beep is for debugging; it makes the PC's speaker beep 250as soon as the kernel's real-mode entry point is called. 251s4_nohwsig prevents ACPI hardware signature from being 252used during resume from hibernation. 253old_ordering causes the ACPI 1.0 ordering of the _PTS 254control method, with respect to putting devices into 255low power states, to be enforced (the ACPI 2.0 ordering 256of _PTS is used by default). 257nonvs prevents the kernel from saving/restoring the 258ACPI NVS memory during suspend/hibernation and resume. 259sci_force_enable causes the kernel to set SCI_EN directly 260on resume from S1/S3 (which is against the ACPI spec, 261but some broken systems don't work without it). 262 263acpi_use_timer_override [HW,ACPI] 47 264Use timer override. For some broken Nvidia NF5 boards 265that require a timer override, but don't have HPET 266 267acpi_enforce_resources=[ACPI] 268{ strict | lax | no } 269Check for resource conflicts between native drivers 270and ACPI OperationRegions (SystemIO and SystemMemory 271only). IO ports and memory declared in ACPI might be 272used by the ACPI subsystem in arbitrary AML code and 273can interfere with legacy drivers. 274strict (default): access to resources claimed by ACPI 275is denied; legacy drivers trying to access reserved 276resources will fail to bind to device using them. 277lax: access to resources claimed by ACPI is allowed; 278legacy drivers trying to access reserved resources 279will bind successfully but a warning message is logged. 280no: ACPI OperationRegions are not marked as reserved, 281no further checks are performed. 282 283ad1848=[HW,OSS] 284Format: ,,,, 285 286add_efi_memmap[EFI; X86] Include EFI memory map in 287kernel's map of available physical RAM. 288 289advansys=[HW,SCSI] 290See header of drivers/scsi/advansys.c. 291 292aedsp16=[HW,OSS] Audio Excel DSP 16 293Format: ,,,,, 294See also header of sound/oss/aedsp16.c. 295 296agp=[AGP] 297{ off | try_unsupported } 298off: disable AGP support 299try_unsupported: try to drive unsupported chipsets 300(may crash computer or cause data corruption) 301 302aha152x=[HW,SCSI] 303See Documentation/scsi/aha152x.txt. 304 305aha1542=[HW,SCSI] 48 306Format: [,,[,]] 307 308aic7xxx=[HW,SCSI] 309See Documentation/scsi/aic7xxx.txt. 310 311aic79xx=[HW,SCSI] 312See Documentation/scsi/aic79xx.txt. 313 314alignment=[KNL,ARM] 315Allow the default userspace alignment fault handler 316behaviour to be specified.Bit 0 enables warnings, 317bit 1 enables fixups, and bit 2 sends a segfault. 318 319amd_iommu=[HW,X86-84] 320Pass parameters to the AMD IOMMU driver in the system. 321Possible values are: 322fullflush - enable flushing of IO/TLB entries when 323they are unmapped. Otherwise they are 324flushed before they will be reused, which 325is a lot of faster 326off- do not initialize any AMD IOMMU found in 327the system 328 329amijoy.map=[HW,JOY] Amiga joystick support 330Map of devices attached to JOY0DAT and JOY1DAT 331Format: , 332See also Documentation/kernel/input/joystick.txt 333 334analog.map=[HW,JOY] Analog joystick and gamepad support 335Specifies type or capabilities of an analog joystick 336connected to one of 16 gameports 337Format: ,,.. 338 339apc=[HW,SPARC] 340Power management functions (SPARCstation-4/5 + deriv.) 341Format: noidle 342Disable APC CPU standby support. SPARCstation-Fox does 343not play well with APC CPU idle - disable it if you have 344APC and your system crashes randomly. 345 346apic=[APIC,X86-32] Advanced Programmable Interrupt Controller 347Change the output verbosity whilst booting 49 348Format: { quiet (default) | verbose | debug } 349Change the amount of debugging information output 350when initialising the APIC and IO-APIC components. 351 352autoconf=[IPV6] 353See Documentation/networking/ipv6.txt. 354 355show_lapic=[APIC,X86] Advanced Programmable Interrupt Controller 356Limit apic dumping. The parameter defines the maximal 357number of local apics being dumped. Also it is possible 358to set it to "all" by meaning -- no limit here. 359Format: { 1 (default) | 2 | ... | all }. 360The parameter valid if only apic=debug or 361apic=verbose is specified. 362Example: apic=debug show_lapic=all 363 364apm=[APM] Advanced Power Management 365See header of arch/x86/kernel/apm_32.c. 366 367arcrimi=[HW,NET] ARCnet - "RIM I" (entirely mem-mapped) cards 368Format: ,, 369 370ataflop=[HW,M68k] 371 372atarimouse=[HW,MOUSE] Atari Mouse 373 374atascsi=[HW,SCSI] Atari SCSI 375 376atkbd.extra=[HW] Enable extra LEDs and keys on IBM RapidAccess, 377EzKey and similar keyboards 378 379atkbd.reset=[HW] Reset keyboard during initialization 380 381atkbd.set=[HW] Select keyboard code set 382Format: (2 = AT (default), 3 = PS/2) 383 384atkbd.scroll=[HW] Enable scroll wheel on MS Office and similar 385keyboards 386 387atkbd.softraw=[HW] Choose between synthetic and real raw mode 388Format: (0 = real, 1 = synthetic (default)) 389 390atkbd.softrepeat= [HW] 50 391Use software keyboard repeat 392 393autotest[IA64] 394 395baycom_epp=[HW,AX25] 396Format: , 397 398baycom_par=[HW,AX25] BayCom Parallel Port AX.25 Modem 399Format: , 400See header of drivers/net/hamradio/baycom_par.c. 401 402baycom_ser_fdx=[HW,AX25] 403BayCom Serial Port AX.25 Modem (Full Duplex Mode) 404Format: ,,[,] 405See header of drivers/net/hamradio/baycom_ser_fdx.c. 406 407baycom_ser_hdx=[HW,AX25] 408BayCom Serial Port AX.25 Modem (Half Duplex Mode) 409Format: ,, 410See header of drivers/net/hamradio/baycom_ser_hdx.c. 411 412boot_delay=Milliseconds to delay each printk during boot. 413Values larger than 10 seconds (10000) are changed to 414no delay (0). 415Format: integer 416 417bootmem_debug[KNL] Enable bootmem allocator debug messages. 418 419bttv.card=[HW,V4L] bttv (bt848 + bt878 based grabber cards) 420bttv.radio=Most important insmod options are available as 421kernel args too. 422bttv.pll=See Documentation/video4linux/bttv/Insmod-options 423bttv.tuner=and Documentation/video4linux/bttv/CARDLIST 424 425BusLogic=[HW,SCSI] 426See drivers/scsi/BusLogic.c, comment before function 427BusLogic_ParseDriverOptions(). 428 429c101=[NET] Moxa C101 synchronous serial card 430 431cachesize=[BUGS=X86-32] Override level 2 CPU cache size detection. 432Sometimes CPU hardware bugs make them report the cache 433size incorrectly. The kernel will attempt work arounds 51 434to fix known problems, but for some CPUs it is not 435possible to determine what the correct size should be. 436This option provides an override for these situations. 437 438capability.disable= 439[SECURITY] Disable capabilities.This would normally 440be used only if an alternative security model is to be 441configured.Potentially dangerous and should only be 442used if you are entirely sure of the consequences. 443 444ccw_timeout_log [S390] 445See Documentation/s390/CommonIO for details. 446 447cgroup_disable= [KNL] Disable a particular controller 448Format: {name of the controller(s) to disable} 449{Currently supported controllers - "memory"} 450 451checkreqprot[SELINUX] Set initial checkreqprot flag value. 452Format: { "0" | "1" } 453See security/selinux/Kconfig help text. 4540 -- check protection applied by kernel (includes 455any implied execute protection). 4561 -- check protection requested by application. 457Default value is set via a kernel config option. 458Value can be changed at runtime via 459/selinux/checkreqprot. 460 461cio_ignore=[S390] 462See Documentation/s390/CommonIO for details. 463 464clock= [BUGS=X86-32, HW] gettimeofday clocksource override. 465[Deprecated] 466Forces specified clocksource (if available) to be used 467when calculating gettimeofday(). If specified 468clocksource is not available, it defaults to PIT. 469Format: { pit | tsc | cyclone | pmtmr } 470 471clocksource=[GENERIC_TIME] Override the default clocksource 472Format: 473Override the default clocksource and use the clocksource 474with the name specified. 475Some clocksource names to choose from, depending on 476the platform: 477[all] jiffies (this is the base, fallback clocksource) 52 478[ACPI] acpi_pm 479[ARM] imx_timer1,OSTS,netx_timer,mpu_timer2, 480pxa_timer,timer3,32k_counter,timer0_1 481[AVR32] avr32 482[X86-32] pit,hpet,tsc,vmi-timer; 483scx200_hrt on Geode; cyclone on IBM x440 484[MIPS] MIPS 485[PARISC] cr16 486[S390] tod 487[SH] SuperH 488[SPARC64] tick 489[X86-64] hpet,tsc 490 491clearcpuid=BITNUM [X86] 492Disable CPUID feature X for the kernel. See 493arch/x86/include/asm/cpufeature.h for the valid bit 494numbers. Note the Linux specific bits are not necessarily 495stable over kernel options, but the vendor specific 496ones should be. 497Also note that user programs calling CPUID directly 498or using the feature without checking anything 499will still see it. This just prevents it from 500being used by the kernel or shown in /proc/cpuinfo. 501Also note the kernel might malfunction if you disable 502some critical bits. 503 504cmo_free_hint=[PPC] Format: { yes | no } 505Specify whether pages are marked as being inactive 506when they are freed.This is used in CMO environments 507to determine OS memory pressure for page stealing by 508a hypervisor. 509Default: yes 510 511code_bytes[X86] How many bytes of object code to print 512in an oops report. 513Range: 0 - 8192 514Default: 64 515 516com20020=[HW,NET] ARCnet - COM20020 chipset 517Format: 518 [,[,[,[,[,]]]]] 519 520com90io=[HW,NET] ARCnet - COM90xx chipset (IO-mapped buffers) 521Format: [,] 53 522 523com90xx=[HW,NET] 524ARCnet - COM90xx chipset (memory-mapped buffers) 525Format: [,[,]] 526 527condev=[HW,S390] console device 528conmode= 529 530console=[KNL] Output console device and options. 531 532tty Use the virtual console device . 533 534ttyS[,options] 535ttyUSB0[,options] 536Use the specified serial port.The options are of 537the form "bbbbpnf", where "bbbb" is the baud rate, 538"p" is parity ("n", "o", or "e"), "n" is number of 539bits, and "f" is flow control ("r" for RTS or 540omit it).Default is "9600n8". 541 542See Documentation/serial-console.txt for more 543information.See 544Documentation/networking/netconsole.txt for an 545alternative. 546 547uart[8250],io,[,options] 548uart[8250],mmio,[,options] 549Start an early, polled-mode console on the 8250/16550 550UART at the specified I/O port or MMIO address, 551switching to the matching ttyS device later.The 552options are the same as for ttyS, above. 553 554If the device connected to the port is not a TTY but a braille 555device, prepend "brl," before the device type, for instance 556console=brl,ttyS0 557For now, only VisioBraille is supported. 558 559consoleblank= [KNL] The console blank (screen saver) timeout in 560seconds. Defaults to 10*60 = 10mins. A value of 0 561disables the blank timer. 562 563coredump_filter= 564[KNL] Change the default value for 565/proc//coredump_filter. 566See also Documentation/filesystems/proc.txt. 567 568cpcihp_generic=[HW,PCI] Generic port I/O CompactPCI driver 54 569Format: 570,,,[,] 571 572crashkernel=nn[KMG]@ss[KMG] 573[KNL] Reserve a chunk of physical memory to 574hold a kernel to switch to with kexec on panic. 575 576crashkernel=range1:size1[,range2:size2,...][@offset] 577[KNL] Same as above, but depends on the memory 578in the running system. The syntax of range is 579start-[end] where start and end are both 580a memory unit (amount[KMG]). See also 581Documentation/kdump/kdump.txt for a example. 582 583cs89x0_dma=[HW,NET] 584Format: 585 586cs89x0_media=[HW,NET] 587Format: { rj45 | aui | bnc } 588 589dasd=[HW,NET] 590See header of drivers/s390/block/dasd_devmap.c. 591 592db9.dev[2|3]=[HW,JOY] Multisystem joystick support via parallel port 593(one device per port) 594Format: , 595See also Documentation/input/joystick-parport.txt 596 597debug[KNL] Enable kernel debugging (events log level). 598 599debug_locks_verbose= 600[KNL] verbose self-tests 601Format= 602Print debugging info while doing the locking API 603self-tests. 604We default to 0 (no extra messages), setting it to 6051 will print _a lot_ more information - normally 606only useful to kernel developers. 607 608debug_objects [KNL] Enable object debugging 609 610no_debug_objects 611[KNL] Disable object debugging 612 613debugpat[X86] Enable PAT debugging 614 615decnet.addr=[HW,NET] 55 616Format: [,] 617See also Documentation/networking/decnet.txt. 618 619default_hugepagesz= 620[same as hugepagesz=] The size of the default 621HugeTLB page size. This is the size represented by 622the legacy /proc/ hugepages APIs, used for SHM, and 623default size when mounting hugetlbfs filesystems. 624Defaults to the default architecture's huge page size 625if not specified. 626 627dhash_entries=[KNL] 628Set number of hash buckets for dentry cache. 629 630digi=[HW,SERIAL] 631IO parameters + enable/disable command. 632 633digiepca=[HW,SERIAL] 634See drivers/char/README.epca and 635Documentation/serial/digiepca.txt. 636 637disable=[IPV6] 638See Documentation/networking/ipv6.txt. 639 640disable_ipv6=[IPV6] 641See Documentation/networking/ipv6.txt. 642 643disable_mtrr_cleanup [X86] 644The kernel tries to adjust MTRR layout from continuous 645to discrete, to make X server driver able to add WB 646entry later. This parameter disables that. 647 648disable_mtrr_trim [X86, Intel and AMD only] 649By default the kernel will trim any uncacheable 650memory out of your available memory pool based on 651MTRR settings.This parameter disables that behavior, 652possibly causing your machine to run very slowly. 653 654disable_timer_pin_1 [X86] 655Disable PIN 1 of APIC timer 656Can be useful to work around chipset bugs. 657 658dmasound=[HW,OSS] Sound subsystem buffers 659 660dma_debug=offIf the kernel is compiled with DMA_API_DEBUG support, 661this option disables the debugging code at boot. 56 662 663dma_debug_entries= 664This option allows to tune the number of preallocated 665entries for DMA-API debugging code. One entry is 666required per DMA-API allocation. Use this if the 667DMA-API debugging code disables itself because the 668architectural default is too low. 669 670dma_debug_driver= 671With this option the DMA-API debugging driver 672filter feature can be enabled at boot time. Just 673pass the driver to filter for as the parameter. 674The filter can be disabled or changed to another 675driver later using sysfs. 676 677dscc4.setup=[NET] 678 679dtc3181e=[HW,SCSI] 680 681dynamic_printkEnables pr_debug()/dev_dbg() calls if 682CONFIG_DYNAMIC_PRINTK_DEBUG has been enabled. 683These can also be switched on/off via 684/dynamic_printk/modules 685 686earlycon=[KNL] Output early console device and options. 687uart[8250],io,[,options] 688uart[8250],mmio,[,options] 689Start an early, polled-mode console on the 8250/16550 690UART at the specified I/O port or MMIO address. 691The options are the same as for ttyS, above. 692 693earlyprintk=[X86,SH,BLACKFIN] 694earlyprintk=vga 695earlyprintk=serial[,ttySn[,baudrate]] 696earlyprintk=ttySn[,baudrate] 697earlyprintk=dbgp[debugController#] 698 699Append ",keep" to not disable it when the real console 700takes over. 701 702Only vga or serial or USB debug port at a time. 703 704Currently only ttyS0 and ttyS1 are supported. 705 706Interaction with the standard serial driver is not 707very good. 708 57 709The VGA output is eventually overwritten by the real 710console. 711 712ekgdboc=[X86,KGDB] Allow early kernel console debugging 713ekgdboc=kbd 714 715This is desgined to be used in conjunction with 716the boot argument: earlyprintk=vga 717 718eata=[HW,SCSI] 719 720edd=[EDD] 721Format: {"off" | "on" | "skip[mbr]"} 722 723eisa_irq_edge=[PARISC,HW] 724See header of drivers/parisc/eisa.c. 725 726elanfreq=[X86-32] 727See comment before function elanfreq_setup() in 728arch/x86/kernel/cpu/cpufreq/elanfreq.c. 729 730elevator=[IOSCHED] 731Format: {"anticipatory" | "cfq" | "deadline" | "noop"} 732See Documentation/block/as-iosched.txt and 733Documentation/block/deadline-iosched.txt for details. 734 735elfcorehdr=[IA64,PPC,SH,X86] 736Specifies physical address of start of kernel core 737image elf header. Generally kexec loader will 738pass this option to capture kernel. 739See Documentation/kdump/kdump.txt for details. 740 741enable_mtrr_cleanup [X86] 742The kernel tries to adjust MTRR layout from continuous 743to discrete, to make X server driver able to add WB 744entry later. This parameter enables that. 745 746enable_timer_pin_1 [X86] 747Enable PIN 1 of APIC timer 748Can be useful to work around chipset bugs 749(in particular on some ATI chipsets). 750The kernel tries to set a reasonable default. 751 752enforcing[SELINUX] Set initial enforcing status. 753Format: {"0" | "1"} 754See security/selinux/Kconfig help text. 7550 -- permissive (log only, no denials). 58 7561 -- enforcing (deny and log). 757Default value is 0. 758Value can be changed at runtime via /selinux/enforce. 759 760erst_disable[ACPI] 761Disable Error Record Serialization Table (ERST) 762support. 763 764ether=[HW,NET] Ethernet cards parameters 765This option is obsoleted by the "netdev=" option, which 766has equivalent usage. See its documentation for details. 767 768failslab= 769fail_page_alloc= 770fail_make_request=[KNL] 771General fault injection mechanism. 772Format: ,,, 773See also /Documentation/fault-injection/. 774 775fd_mcs=[HW,SCSI] 776See header of drivers/scsi/fd_mcs.c. 777 778fdomain=[HW,SCSI] 779See header of drivers/scsi/fdomain.c. 780 781floppy=[HW] 782See Documentation/blockdev/floppy.txt. 783 784force_pal_cache_flush 785[IA-64] Avoid check_sal_cache_flush which may hang on 786buggy SAL_CACHE_FLUSH implementations. Using this 787parameter will force ia64_sal_cache_flush to call 788ia64_pal_cache_flush instead of SAL_CACHE_FLUSH. 789 790ftrace=[tracer] 791[FTRACE] will set and start the specified tracer 792as early as possible in order to facilitate early 793boot debugging. 794 795ftrace_dump_on_oops[=orig_cpu] 796[FTRACE] will dump the trace buffers on oops. 797If no parameter is passed, ftrace will dump 798buffers of all CPUs, but if you pass orig_cpu, it will 799dump only the buffer of the CPU that triggered the 59 800oops. 801 802ftrace_filter=[function-list] 803[FTRACE] Limit the functions traced by the function 804tracer at boot up. function-list is a comma separated 805list of functions. This list can be changed at run 806time by the set_ftrace_filter file in the debugfs 807tracing directory.808 809ftrace_notrace=[function-list] 810[FTRACE] Do not trace the functions specified in 811function-list. This list can be changed at run time 812by the set_ftrace_notrace file in the debugfs 813tracing directory. 814 815ftrace_graph_filter=[function-list] 816[FTRACE] Limit the top level callers functions traced 817by the function graph tracer at boot up. 818function-list is a comma separated list of functions 819that can be changed at run time by the 820set_graph_function file in the debugfs tracing directory. 821 822gamecon.map[2|3]= 823[HW,JOY] Multisystem joystick and NES/SNES/PSX pad 824support via parallel port (up to 5 devices per port) 825Format: ,,,,, 826See also Documentation/input/joystick-parport.txt 827 828gamma=[HW,DRM] 829 830gart_fix_e820=[X86_64] disable the fix e820 for K8 GART 831Format: off | on 832default: on 833 834gcov_persist=[GCOV] When non-zero (default), profiling data for 835kernel modules is saved and remains accessible via 836debugfs, even when the module is unloaded/reloaded. 837When zero, profiling data is discarded and associated 838debugfs files are removed at module unload time. 839 840gdth=[HW,SCSI] 841See header of drivers/scsi/gdth.c. 842 843gpt[EFI] Forces disk with valid GPT signature but 844invalid Protective MBR to be treated as GPT. 60 845 846gvp11=[HW,SCSI] 847 848hashdist=[KNL,NUMA] Large hashes allocated during boot 849are distributed across NUMA nodes.Defaults on 850for 64bit NUMA, off otherwise. 851Format: 0 | 1 (for off | on) 852 853hcl=[IA-64] SGI's Hardware Graph compatibility layer 854 855hd=[EIDE] (E)IDE hard drive subsystem geometry 856Format: ,, 857 858hest_disable[ACPI] 859Disable Hardware Error Source Table (HEST) support; 860corresponding firmware-first mode error processing 861logic will be disabled. 862 863highmem=nn[KMG][KNL,BOOT] forces the highmem zone to have an exact 864size of . This works even on boxes that have no 865highmem otherwise. This also works to reduce highmem 866size on bigger boxes. 867 868highres=[KNL] Enable/disable high resolution timer mode. 869Valid parameters: "on", "off" 870Default: "on" 871 872hisax= [HW,ISDN] 873See Documentation/isdn/README.HiSax. 874 875hlt[BUGS=ARM,SH] 876 877hpet=[X86-32,HPET] option to control HPET usage 878Format: { enable (default) | disable | force | 879verbose } 880disable: disable HPET and use PIT instead 881force: allow force enabled of undocumented chips (ICH4, 882VIA, nVidia) 883verbose: show contents of HPET registers during setup 884 885hugepages=[HW,X86-32,IA-64] HugeTLB pages to allocate at boot. 886hugepagesz=[HW,IA-64,PPC,X86-64] The size of the HugeTLB pages. 887On x86-64 and powerpc, this option can be specified 61 888multiple times interleaved with hugepages= to reserve 889huge pages of different sizes. Valid pages sizes on 890x86-64 are 2M (when the CPU supports "pse") and 1G 891(when the CPU supports the "pdpe1gb" cpuinfo flag) 892Note that 1GB pages can only be allocated at boot time 893using hugepages= and not freed afterwards. 894 895hvc_iucv=[S390] Number of z/VM IUCV hypervisor console (HVC) 896 terminal devices. Valid values: 0..8 897hvc_iucv_allow=[S390] Comma-separated list of z/VM user IDs. 898 If specified, z/VM IUCV HVC accepts connections 899 from listed z/VM user IDs only. 900 901i2c_bus=[HW] Override the default board specific I2C bus speed 902 or register an additional I2C bus that is not 903 registered from board initialization code. 904 Format: 905 , 906 907i8042.debug[HW] Toggle i8042 debug mode 908i8042.direct[HW] Put keyboard port into non-translated mode 909i8042.dumbkbd[HW] Pretend that controller can only read data from 910 keyboard and cannot control its state 911 (Don't attempt to blink the leds) 912i8042.noaux[HW] Don't check for auxiliary (== mouse) port 913i8042.nokbd[HW] Don't check/create keyboard port 914i8042.noloop[HW] Disable the AUX Loopback command while probing 915 for the AUX port 916i8042.nomux[HW] Don't check presence of an active multiplexing 917 controller 918i8042.nopnp[HW] Don't use ACPIPnP / PnPBIOS to discover KBD/AUX 919 controllers 920i8042.panicblink= 921[HW] Frequency with which keyboard LEDs should blink 922 when kernel panics (default is 0.5 sec) 923i8042.reset[HW] Reset the controller during init and cleanup 924i8042.unlock[HW] Unlock (ignore) the keylock 925 926i810=[HW,DRM] 927 62 928i8k.ignore_dmi[HW] Continue probing hardware even if DMI data 929indicates that the driver is running on unsupported 930hardware. 931i8k.force[HW] Activate i8k driver even if SMM BIOS signature 932does not match list of supported models. 933i8k.power_status 934[HW] Report power status in /proc/i8k 935(disabled by default) 936i8k.restricted[HW] Allow controlling fans only if SYS_ADMIN 937capability is set. 938 939ibmmcascsi=[HW,MCA,SCSI] IBM MicroChannel SCSI adapter 940See Documentation/mca.txt. 941 942icn=[HW,ISDN] 943Format: [,[,[,]]] 944 945ide-core.nodma=[HW] (E)IDE subsystem 946Format: =0.0 to prevent dma on hda, =0.1 hdb =1.0 hdc 947.vlb_clock .pci_clock .noflush .nohpa .noprobe .nowerr 948.cdrom .chs .ignore_cable are additional options 949See Documentation/ide/ide.txt. 950 951ide-pci-generic.all-generic-ide [HW] (E)IDE subsystem 952Claim all unknown PCI IDE storage controllers. 953 954idle=[X86] 955Format: idle=poll, idle=mwait, idle=halt, idle=nomwait 956Poll forces a polling idle loop that can slightly 957improve the performance of waking up a idle CPU, but 958will use a lot of power and make the system run hot. 959Not recommended. 960idle=mwait: On systems which support MONITOR/MWAIT but 961the kernel chose to not use it because it doesn't save 962as much power as a normal idle loop, use the 963MONITOR/MWAIT idle loop anyways. Performance should be 964the same as idle=poll. 965idle=halt: Halt is forced to be used for CPU idle. 966In such case C2/C3 won't be used again. 967idle=nomwait: Disable mwait for CPU C-states 968 969ignore_loglevel[KNL] 970Ignore loglevel setting - this will print /all/ 971kernel messages to the console. Useful for debugging. 972 63 973ihash_entries= [KNL] 974Set number of hash buckets for inode cache. 975 976ima_audit=[IMA] 977Format: { "0" | "1" } 9780 -- integrity auditing messages. (Default) 9791 -- enable informational integrity auditing messages. 980 981ima_hash=[IMA] 982Format: { "sha1" | "md5" } 983default: "sha1" 984 985ima_tcb[IMA] 986Load a policy which meets the needs of the Trusted 987Computing Base.This means IMA will measure all 988programs exec'd, files mmap'd for exec, and all files 989opened for read by uid=0. 990 991in2000=[HW,SCSI] 992See header of drivers/scsi/in2000.c. 993 994init=[KNL] 995Format: 996Run specified binary instead of /sbin/init as init 997process. 998 999initcall_debug [KNL] Trace initcalls as they are executed.Useful 1000for working out where the kernel is dying during 1001startup. 1002 1003initrd= [BOOT] Specify the location of the initial ramdisk 1004 1005inport.irq=[HW] Inport (ATI XL and Microsoft) busmouse driver 1006Format: 1007 1008intel_iommu= [DMAR] Intel IOMMU driver (DMAR) option 1009on 1010Enable intel iommu driver. 1011off 1012Disable intel iommu driver. 1013igfx_off [Default Off] 1014By default, gfx is mapped as normal device. If a gfx 1015device has a dedicated DMAR unit, the DMAR unit is 1016bypassed by not enabling DMAR with this option. In 1017this case, gfx device will use physical address for 1018DMA. 1019forcedac [x86_64] 1020With this option iommu will not optimize to look 64 1021for io virtual address below 32 bit forcing dual 1022address cycle on pci bus for cards supporting greater 1023than 32 bit addressing. The default is to look 1024for translation below 32 bit and if not available 1025then look in the higher range. 1026strict [Default Off] 1027With this option on every unmap_single operation will 1028result in a hardware IOTLB flush operation as opposed 1029to batching them for performance. 1030 1031inttest=[IA64] 1032 1033iomem=Disable strict checking of access to MMIO memory 1034strictregions from userspace. 1035relaxed 1036 1037iommu=[x86] 1038off 1039force 1040noforce 1041biomerge 1042panic 1043nopanic 1044merge 1045nomerge 1046forcesac 1047soft 1048pt[x86, IA64] 1049 1050io7=[HW] IO7 for Marvel based alpha systems 1051See comment before marvel_specify_io7 in 1052arch/alpha/kernel/core_marvel.c. 1053 1054io_delay=[X86] I/O delay method 10550x80 1056Standard port 0x80 based delay 10570xed 1058Alternate port 0xed based delay (needed on some systems) 1059udelay 1060Simple two microseconds delay 1061none 1062No delay 1063 1064ip=[IP_PNP] 1065See Documentation/filesystems/nfs/nfsroot.txt. 1066 65 1067ip2=[HW] Set IO/IRQ pairs for up to 4 IntelliPort boards 1068See comment before ip2_setup() in 1069drivers/char/ip2/ip2base.c. 1070 1071ips=[HW,SCSI] Adaptec / IBM ServeRAID controller 1072See header of drivers/scsi/ips.c. 1073 1074irqfixup[HW] 1075When an interrupt is not handled search all handlers 1076for it. Intended to get systems with badly broken 1077firmware running. 1078 1079irqpoll[HW] 1080When an interrupt is not handled search all handlers 1081for it. Also check all handlers each timer 1082interrupt. Intended to get systems with badly broken 1083firmware running. 1084 1085isapnp=[ISAPNP] 1086Format: ,,, 1087 1088isolcpus=[KNL,SMP] Isolate CPUs from the general scheduler. 1089Format: 1090,..., 1091or 1092- 1093(must be a positive range in ascending order) 1094or a mixture 1095,...,- 1096 1097This option can be used to specify one or more CPUs 1098to isolate from the general SMP balancing and scheduling 1099algorithms. You can move a process onto or off an 1100"isolated" CPU via the CPU affinity syscalls or cpuset. 1101 begins at 0 and the maximum value is 1102"number of CPUs in system - 1". 1103 1104This option is the preferred way to isolate CPUs. The 1105alternative -- manually setting the CPU mask of all 1106tasks in the system -- can cause problems and 1107suboptimal load balancer performance. 1108 1109iucv=[HW,NET] 1110 1111js=[HW,JOY] Analog joystick 1112See Documentation/input/joystick.txt. 1113 66 1114keepinitrd[HW,ARM] 1115 1116kernelcore=nn[KMG] [KNL,X86,IA-64,PPC] This parameter 1117specifies the amount of memory usable by the kernel 1118for non-movable allocations.The requested amount is 1119spread evenly throughout all nodes in the system. The 1120remaining memory in each node is used for Movable 1121pages. In the event, a node is too small to have both 1122kernelcore and Movable pages, kernelcore pages will 1123take priority and other nodes will have a larger number 1124of kernelcore pages.The Movable zone is used for the 1125allocation of pages that may be reclaimed or moved 1126by the page migration subsystem.This means that 1127HugeTLB pages may not be allocated from this zone. 1128Note that allocations like PTEs-from-HighMem still 1129use the HighMem zone if it exists, and the Normal 1130zone if it does not. 1131 1132kgdbdbgp=[KGDB,HW] kgdb over EHCI USB debug port. 1133Format: [,poll interval] 1134The controller # is the number of the ehci USB debug 1135port as it is probed via PCI.The poll interval is 1136optional and is the number seconds in between 1137each poll cycle to the debug port in case you need 1138the functionality for interrupting the kernel with 1139gdb or control-c on the dbgp connection.When 1140not using this parameter you use sysrq-g to break into 1141the kernel debugger. 1142 1143kgdboc=[KGDB,HW] kgdb over consoles. 1144Requires a tty driver that supports console polling, 1145or a supported polling keyboard driver (non-USB). 1146Serial only format: [,baud] 1147keyboard only format: kbd 1148keyboard and serial format: kbd,[,baud] 1149 1150kgdbwait[KGDB] Stop kernel execution and enter the 1151kernel debugger at the earliest opportunity. 1152 1153kmac= [MIPS] korina ethernet MAC address. 1154Configure the RouterBoard 532 series on-chip 1155Ethernet adapter MAC address. 1156 1157kmemleak=[KNL] Boot-time kmemleak enable/disable 1158Valid arguments: on, off 1159Default: on 1160 67 1161kstack=N[X86] Print N words from the kernel stack 1162in oops dumps. 1163 1164kvm.ignore_msrs=[KVM] Ignore guest accesses to unhandled MSRs. 1165Default is 0 (don't ignore, but inject #GP) 1166 1167kvm.oos_shadow=[KVM] Disable out-of-sync shadow paging. 1168Default is 1 (enabled) 1169 1170kvm-amd.nested=[KVM,AMD] Allow nested virtualization in KVM/SVM. 1171Default is 0 (off) 1172 1173kvm-amd.npt= [KVM,AMD] Disable nested paging (virtualized MMU) 1174for all guests. 1175Default is 1 (enabled) if in 64bit or 32bit-PAE mode 1176 1177kvm-intel.bypass_guest_pf= 1178[KVM,Intel] Disables bypassing of guest page faults 1179on Intel chips. Default is 1 (enabled) 1180 1181kvm-intel.ept= [KVM,Intel] Disable extended page tables 1182(virtualized MMU) support on capable Intel chips. 1183Default is 1 (enabled) 1184 1185kvm-intel.emulate_invalid_guest_state= 1186[KVM,Intel] Enable emulation of invalid guest states 1187Default is 0 (disabled) 1188 1189kvm-intel.flexpriority= 1190[KVM,Intel] Disable FlexPriority feature (TPR shadow). 1191Default is 1 (enabled) 1192 1193kvm-intel.unrestricted_guest= 1194[KVM,Intel] Disable unrestricted guest feature 1195(virtualized real and unpaged mode) on capable 1196Intel chips. Default is 1 (enabled) 1197 1198kvm-intel.vpid=[KVM,Intel] Disable Virtual Processor Identification 1199feature (tagged TLBs) on capable Intel chips. 1200Default is 1 (enabled) 1201 1202l2cr=[PPC] 1203 1204l3cr=[PPC] 68 1205 1206lapic[X86-32,APIC] Enable the local APIC even if BIOS 1207disabled it. 1208 1209lapic_timer_c2_ok[X86,APIC] trust the local apic timer 1210in C2 power state. 1211 1212libata.dma=[LIBATA] DMA control 1213libata.dma=0Disable all PATA and SATA DMA 1214libata.dma=1PATA and SATA Disk DMA only 1215libata.dma=2ATAPI (CDROM) DMA only 1216libata.dma=4Compact Flash DMA only1217Combinations also work, so libata.dma=3 enables DMA 1218for disks and CDROMs, but not CFs. 1219 1220libata.ignore_hpa=[LIBATA] Ignore HPA limit 1221libata.ignore_hpa=0keep BIOS limits (default) 1222libata.ignore_hpa=1ignore limits, using full disk 1223 1224libata.noacpi[LIBATA] Disables use of ACPI in libata suspend/resume 1225when set. 1226Format: 1227 1228libata.force=[LIBATA] Force configurations.The format is comma 1229separated list of "[ID:]VAL" where ID is 1230PORT[.DEVICE].PORT and DEVICE are decimal numbers 1231matching port, link or device.Basically, it matches 1232the ATA ID string printed on console by libata.If 1233the whole ID part is omitted, the last PORT and DEVICE 1234values are used.If ID hasn't been specified yet, the 1235configuration applies to all ports, links and devices. 1236 1237If only DEVICE is omitted, the parameter applies to 1238the port and all links and devices behind it.DEVICE 1239number of 0 either selects the first device or the 1240first fan-out link behind PMP device.It does not 1241select the host link.DEVICE number of 15 selects the 1242host link and device attached to it. 1243 1244The VAL specifies the configuration to force.As long 1245as there's no ambiguity shortcut notation is allowed. 1246For example, both 1.5 and 1.5G would work for 1.5Gbps. 1247The following configurations can be forced. 69 1248 1249* Cable type: 40c, 80c, short40c, unk, ign or sata. 1250Any ID with matching PORT is used. 1251 1252* SATA link speed limit: 1.5Gbps or 3.0Gbps. 1253 1254* Transfer mode: pio[0-7], mwdma[0-4] and udma[0-7]. 1255udma[/][16,25,33,44,66,100,133] notation is also 1256allowed. 1257 1258* [no]ncq: Turn on or off NCQ. 1259 1260* nohrst, nosrst, norst: suppress hard, soft 1261and both resets. 1262 1263* dump_id: dump IDENTIFY data. 1264 1265If there are multiple matching configurations changing 1266the same attribute, the last one is used. 1267 1268memblock=debug[KNL] Enable memblock debug messages. 1269 1270load_ramdisk=[RAM] List of ramdisks to load from floppy 1271See Documentation/blockdev/ramdisk.txt. 1272 1273lockd.nlm_grace_period=P[NFS] Assign grace period. 1274Format: 1275 1276lockd.nlm_tcpport=N[NFS] Assign TCP port. 1277Format: 1278 1279lockd.nlm_timeout=T [NFS] Assign timeout value. 1280Format: 1281 1282lockd.nlm_udpport=M[NFS] Assign UDP port. 1283Format: 1284 1285logibm.irq=[HW,MOUSE] Logitech Bus Mouse Driver 1286Format: 1287 1288loglevel=All Kernel Messages with a loglevel smaller than the 1289console loglevel will be printed to the console. It can 1290also be changed with klogd or other programs. The 1291loglevels are defined as follows: 1292 12930 (KERN_EMERG)system is unusable 70 12941 (KERN_ALERT)action must be taken immediately 12952 (KERN_CRIT)critical conditions 12963 (KERN_ERR)error conditions 12974 (KERN_WARNING)warning conditions 12985 (KERN_NOTICE)normal but significant condition 12996 (KERN_INFO)informational 13007 (KERN_DEBUG)debug-level messages 1301 1302log_buf_len=n Sets the size of the printk ring buffer, in bytes. 1303Format: { n | nk | nM } 1304n must be a power of two.The default size 1305is set in the kernel config file. 1306 1307logo.nologo[FB] Disables display of the built-in Linux logo. 1308This may be used to provide more screen space for 1309kernel log messages and is useful when debugging 1310kernel boot problems. 1311 1312lp=0[LP]Specify parallel ports to use, e.g, 1313lp=port[,port...]lp=none,parport0 (lp0 not configured, lp1 uses 1314lp=resetfirst parallel port). 'lp=0' disables the 1315lp=autoprinter driver. 'lp=reset' (which can be 1316specified in addition to the ports) causes 1317attached printers to be reset. Using 1318lp=port1,port2,... specifies the parallel ports 1319to associate lp devices with, starting with 1320lp0. A port specification may be 'none' to skip 1321that lp device, or a parport name such as 1322'parport0'. Specifying 'lp=auto' instead of a 1323port specification list means that device IDs 1324from each port should be examined, to see if 1325an IEEE 1284-compliant printer is attached; if 1326so, the driver will manage that printer. 1327See also header of drivers/char/lp.c. 1328 1329lpj=n[KNL] 1330Sets loops_per_jiffy to given constant, thus avoiding 1331time-consuming boot-time autodetection (up to 250 ms per 1332CPU). 0 enables autodetection (default). To determine 1333the correct value for your kernel, boot with normal 1334autodetection and see what value is printed. Note that 1335on SMP systems the preset will be applied to all CPUs, 1336which is likely to cause problems if your CPUs need 1337significantly divergent settings. An incorrect value 1338will cause delays in the kernel to be wrong, leading to 71 1339unpredictable I/O errors and other breakage. Although 1340unlikely, in the extreme case this might damage your 1341hardware. 1342 1343ltpc=[NET] 1344Format: ,, 1345 1346mac5380=[HW,SCSI] Format: 1347 ,,,, 1348 1349machvec=[IA64] Force the use of a particular machine-vector 1350(machvec) in a generic kernel. 1351Example: machvec=hpzx1_swiotlb 1352 1353machtype=[Loongson] Share the same kernel image file between different 1354 yeeloong laptop. 1355Example: machtype=lemote-yeeloong-2f-7inch 1356 1357max_addr=nn[KMG][KNL,BOOT,ia64] All physical memory greater 1358than or equal to this physical address is ignored. 1359 1360maxcpus=[SMP] Maximum number of processors that an SMP kernel 1361should make use of.maxcpus=n : n >= 0 limits the 1362kernel to using 'n' processors.n=0 is a special case, 1363it is equivalent to "nosmp", which also disables 1364the IO APIC. 1365 1366max_loop=[LOOP] Maximum number of loopback devices that can 1367be mounted 1368Format: 1369 1370max_luns=[SCSI] Maximum number of LUNs to probe. 1371Should be between 1 and 2^32-1. 1372 1373max_report_luns= 1374[SCSI] Maximum number of LUNs received. 1375Should be between 1 and 16384. 1376 1377mcatest=[IA-64] 1378 1379mce[X86-32] Machine Check Exception 1380 72 1381mce=option[X86-64] See Documentation/x86/x86_64/boot-options.txt 1382 1383md=[HW] RAID subsystems devices and level 1384See Documentation/md.txt. 1385 1386mdacon=[MDA] 1387Format: , 1388Specifies range of consoles to be captured by the MDA. 1389 1390mem=nn[KMG][KNL,BOOT] Force usage of a specific amount of memory 1391Amount of memory to be used when the kernel is not able 1392to see the whole system memory or for test. 1393[X86-32] Use together with memmap= to avoid physical 1394address space collisions. Without memmap= PCI devices 1395could be placed at addresses belonging to unused RAM. 1396 1397mem=nopentium[BUGS=X86-32] Disable usage of 4MB pages for kernel 1398memory. 1399 1400memchunk=nn[KMG] 1401[KNL,SH] Allow user to override the default size for 1402per-device physically contiguous DMA buffers. 1403 1404memmap=exactmap[KNL,X86] Enable setting of an exact 1405E820 memory map, as specified by the user. 1406Such memmap=exactmap lines can be constructed based on 1407BIOS output or other requirements. See the memmap=nn@ss 1408option description. 1409 1410memmap=nn[KMG]@ss[KMG] 1411[KNL] Force usage of a specific region of memory 1412Region of memory to be used, from ss to ss+nn. 1413 1414memmap=nn[KMG]#ss[KMG] 1415[KNL,ACPI] Mark specific memory as ACPI data. 1416Region of memory to be used, from ss to ss+nn. 1417 1418memmap=nn[KMG]$ss[KMG] 73 1419[KNL,ACPI] Mark specific memory as reserved. 1420Region of memory to be used, from ss to ss+nn. 1421Example: Exclude memory from 0x18690000-0x1869ffff 1422 memmap=64K$0x18690000 1423 or 1424 memmap=0x10000$0x18690000 1425 1426memory_corruption_check=0/1 [X86] 1427Some BIOSes seem to corrupt the first 64k of 1428memory when doing things like suspend/resume. 1429Setting this option will scan the memory 1430looking for corruption.Enabling this will 1431both detect corruption and prevent the kernel 1432from using the memory being corrupted. 1433However, its intended as a diagnostic tool; if 1434repeatable BIOS-originated corruption always 1435affects the same memory, you can use memmap= 1436to prevent the kernel from using that memory. 1437 1438memory_corruption_check_size=size [X86] 1439By default it checks for corruption in the low 144064k, making this memory unavailable for normal 1441use.Use this parameter to scan for 1442corruption in more or less memory. 1443 1444memory_corruption_check_period=seconds [X86] 144