Hidden files saved by Mac OS X into USB drive

Here is description how to do this http://www.cl.cam.ac.uk/~osc22/tutorials/linux_on_macbook_air.html

Booting linux from USB drive on a recent MacBook air (e.g. late 2010) - even with FileVault 2

I've spent a while figuring out how to boot linux on my MacBook air 3.2 (aka late 2010) from an USB stick, since I needed to image its disk before and after enabling full disk encryption (Lion's FileVault 2).

There are many tutorials out there but most of them either don't work, are not for the correct combination of hardware/software or miss some details. So here I give you the facts for booting a linux live image (I've used Ubuntu) with a MacBook Air that perhaps has Lion (although I am sure it works with Snow Leopard as well) and may be even with FileVault2 (full-disk encryption) enabled.

If you don't have FileVault enabled, I recommend you install rEFIt from your Mac OS X using the dmg installer, and follow the steps at the END of this page. Now, for the details....

If you can, use Ubuntu (yes, from a different PC) to create the USB drive with Ubuntu by means of "Startup Disk Creator" (See System/Administration). Once you have the USB drive, if you run mmls (a forensic utility from the sleuth kit), you should see actually several partitions including a Win 95 Fat32 (0x0C). This is actually the partition you need to dd, i.e. "dd if=/dev/disk2s02 of=/dev/disk0s3" bs=1M count="size_of_that_partition_in_blocks"; where disk2s02 is the Win95 FAT32 partition in the USB drive and disk0s3 is a partition you have created on your Mac disk). Now (having installed rEFIt as I mentioned above), reboot your MacBook and use the partition utility of rEFIt (one of the items) to fix the MBR (is a hybrid MBR/GPT partition table). Simply answer yes to have the linux partition (the one where you've copied from the USB) correctly set up. Restart again the MacBook and use rEFIt to boot the linux install/live partition. Now, if you have FileVault enabled things are a bit more tricky. The reference post about how to do this is here. However, again there are some details that should be made clear.

First of all, I highly recommend you do an image of your drive (either directly from MacOS by using the low-level disk, e.g. /dev/disk0 - not the one showing as /dev/disk1 unencrypted). There is a risk you won't be able to boot OS X anymore after you apply these steps. Next, follow the steps in the post I mentioned above. When it refers to "bless" the efi partition, look at the end of the post in the StopService() code and you should see what to do. gpt fdisk refers to the command "gdisk" in repair mode (r). Here you need to use the Hybrid MBR, by typing (h). I recommend you read this. When asked for partition code use "0C" (Windows95 FAT32 for your linux partition). I'm not sure if is a good idea to put the EFI partition (code 0xEE) at the beginning, or if you should create extra protective MBR partitions. I've put the EFI partition at the end and didn't create any extra protective MBR partitions and I was able to boot linux. However I wasn't able to boot the Mac OS X anymore. So that's why I recommend the prior image. Looking at the results and comparing with the partitions in a USB drive with rEFIt I suggest you actually create all the protective MBR partitions suggested by "gdisk". I've recently purchased a Macbook Air superdrive. You can easily boot linux using that and avoid all the trouble and possible problems with the steps above. So if you want the quick and safe way I suggest you spend about $66 and take the superdrive. It works also when FileVault 2 is enabled.

It seems that those after 2009 (which reverted to 4 USB ports instead of 5), only have 2 buses. The 2009 models are likely the only models with 3 USB buses.

If you get one of the newer ones with Thunderbolt, it's possible to connect to a Thunderbolt Display which would add a third hub. I don't know of any devices off-hand that will give you just another USB hub via Thunderbolt, but if they're not out there already, they're bound to show up.