When you NetBoot, the read-only NetBoot DMG file gets mounted read-write via the use of a Shadow File. Any Mac OS X DMG file can be mounted with a Shadow file. When a Shadow file is in use, any data which would be written to the DMG file is instead written to the Shadow file, and when data is read, the data will be read from the Shadow file first before the DMG file.
When NetBooting, there are three kinds of images, each with three different methods of mounting the DMG and storing the Shadow file:
- NetInstall Images are made from a Mac OS X Installer DVD or an Installer Image downloaded from the App Store. They have no Shadow file, the root partition
/
is read only and there is no swap.
- NetBoot Images are made using System Image Utility from an installed Mac OS X system. the Shadow file is stored on the first hard disk in the hidden
/private/netboot
folder
- Diskless Netboot Images are the same as NetBoot Images but the Shadow file is stored over the network using Apple File Protocol (AFP)
In the case of Diskless Netboot (The most powerful), the Shadow file is stored in the NetBootClients0
folder of the Library/NetBoot
folder on the server machine (Or NetBootClients1
, NetBootClients2, etc, where the number matches the number of the
NetBootSP` folder in which the Net Boot DMG resides)
To make a NetBoot image a Diskless Netboot Image, use the "Make this image available for Diskless booting" checkbox under the image settings in Server.app:
You also need to have AFP File Sharing enabled, and you need a guest writable sharepoint for the NetBoot directory. (I do not recall if Server.app creates this automatically) Apple has a document about troubleshooting Diskless NetBoot which is helpful. AFP548 also has some great hints
When a client machine boots a specific net boot image, my understanding is that it copies at least the most necessary parts of the image via network and stores it somehow on its local resources
This is not technically correct. When you NetBoot, the Mac OS X Kernel mounts the root filesystem (/
, the boot volume) over the network. So nothing is stored locally. When data needs to be read (E.G. an application is launched) it is read over the network, rather than from your hard drive. No data is copied from the server to the local machine.
When changes are made, for example, a new file is saved, then the Mac OS X kernel needs to write those changes somewhere, and that's where the Shadow file comes in. As described above the Shadow file might be on the first local hard drive, but it might also be stored over the network. If it is stored over the network, then the Mac OS X client can actually unmount the drives and do things like running Disk Utility. It can even have the hard drives completely removed.
In general, once a Unix file is deleted, it's deleted. That said, there are certain 3rd party utilities that may be able to scour your HD for file signatures that match the file format you used (PDF?) and recover the file. Here is a review of the 3 biggest titles for you to choose from: http://www.techrepublic.com/article/3-data-recovery-applications-for-os-x/
One issue that is critical: Stop using the Mac. The more you use it and save/alter files, the more likely the disk sectors that contained your scan will get overwritten.
Best Answer
It's stored in an extended attribute on the file. Specifically the
com.apple.metadata:kMDItemWhereFroms
attribute. It may stay with the file when you move it to different computers, but it depends on the filesystem or file sharing protocol you use. If you move it to another Mac on an HFS+ disk, it will likely keep it, but not necessarily if you transfer over the network, and most likely not with an external disk with a non-HFS+ filesystem.You can check a file by running
xattr -lp com.apple.metadata:kMDItemWhereFroms myfile
in the Terminal, or remove it withxattr -d com.apple.metadata:kMDItemWhereFroms my file
.ls -l@
flag is also useful; it will list the names of xattrs along with the usual ls information.If you want to remove it from multiple files, have a look at this question: How to remove xattr com.apple.quarantine from all .webarchive files with that extended attribute?