One of the biggest advantages to having a Macbook is the ability to have all three mainstream OSes on one device – invaluable if you work with a variety of tools, as is often the case in the DFIR world.
I’ve done this a couple of times in the past and found some very useful guides, but with the advent of APFS, GPT partitioning and newer versions of Mac/Windows, it’s a little different to doing this on a HFS+ drive.
It’s not particuarly hard, but can be fiddly. A huge failsafe here is having your Mac OS backed up on Time Machine – should the (absolute) worst happen, a system restore is painless.
Disclaimer – this does involve messing around with bootloaders. This could potentially lead to a situation where your system does not boot. While following this guide *should* give you a beautifully crafted triple booting Mac, it may also lead to a non-bootable laptop. Please ensure you have backed up all your data before proceeding!
I’ve curated this from a number of guides which covered some/most of the procedures and issues (listed at the end). This guide puts all the key issues I’ve encountered in one place for others!
What you’ll need:
A Macbook (obvs)
A Windows 10 ISO and licence key
A USB stick with your flavour of Linux install (I went for Mint) (I recommend using Rufus to make your USB installer, YMMV)
A download of Refind on your Mac OS. This is used to manage your multi-install system, getting the various bootloaders to work together.
Step 1: Bootcamp Your Mac
The first step (if you don’t already) is to get a Bootcamp installation of Windows. You can do this using the included Bootcamp Assistant on MacOS. All you need is a Windows ISO (either 8 or 10) and a correct licence key. The key thing you must have however, is a Bootcamp partition size big enough for both Windows and Linux.
For example, I wanted to split my 500GB drive as follows:
300GB Mac OS | 150GB Windows | 50GB Linux
In order to get this, I allocated 200GB to the Bootcamp partition; I’ll resize that later.
Before you start installing Windows, unzip the Refind application to somewhere relatively easy to find on your Mac (as you’ll need to get to it in console later). I suggest Downloads or Documents. Now you can fire up the Bootcamp Assistant and get installing!
Once you’ve got Windows installed, it’s time to create the partition for your Linux install.
Step 2: Make Space for Linux!
This is pretty straightforward. Firstly, right click on “This PC” from the list of devices on the left in Windows Explorer, select “Manage”. Then select “Disk Management” under “Storage” in the screen that pops up.
Here, you should see your drive that Windows is installed on. Right click and select “Shrink Volume”. Drop it down so you get the desired split between your Windows and Linux partitions.
You don’t need to format this new space, we’ll be doing that in Linux.
Step 3: Install Linux
This can always be a tricky step – Linux drive designations are very different to Windows or Mac and there can be confusion about how the install is configured: “mount points?” “swap partition?”
Firstly, plug in your Linux USB and boot to it using the Alt key. You’ll get an option to “try (linux variant) or “install (linux variant)”. Select the “try” option. Once Linux has booted up, select the “Install Linux” option from the desktop.
You will be presented with the option to let the installer set up Linux partitions for you. Don’t let it do this! It will undo all your hard work and you’ll have to start from scratch. Instead, select “Do something else” instead.
You’ll now be asked to configure the Linux installer. It can be a bit difficult to work out what’s going on here. The main bits you need to know:
- Make sure you select the empty space you made in Windows to install Linux to. It will be called something like /dev/sda5. You should be able to identify it as it’ll be the size you specified in Disk Management in Windows.
- When the “Edit Partition” pop up appears, select “Use as: Ext4 Journalling File System”
- You’ll also be asked where you want the mount point to be. Select “/” which is the root of the partition.
- You’ll also be asked to point at the “Device for Boot Loader Installation”. This will be /dev/sda1 which is the root of your disk. This lumps the Linux bootloader in with Mac & Windows. We’ll sort that out shortly….
- You can install a swap partition. This is used to supplement the RAM on your system. It’s completely optional, but you may get a warning if you don’t create one. As a rule of thumb, your swap partition should be around twice the size of your RAM (e.g. 8GB of RAM – 16GB swap). If you’ve got a decent amount of RAM, you shouldn’t need this.
At this point, you now technically have a triple install. Hooray! However, Windows will now refuse to boot as the Linux install has just overwritten the Windows bootloader. Boo! Time to sort this out!
Step 4 – Fix The Windows Install
Once you have Linux installed, you’ll need to remake the Windows bootloader as Linux has overwritten it!
This is simply done from within the Linux install, open up a terminal and type:
sudo gdisk /dev/sda (if this doesn’t work, you may need to install gdisk with the command: sudo apt-get install gdisk
Type p to view the partition table. This should show you the /dev/sda1 disk.
Type x to bring up the expert menu
Type n to create an empty MBR. You don’t get a confirmation of this being created, but you should just get another expert prompt.
Type w to save your changes, confirm and exit.
This should now fix the Windows bootloader and you can now boot into any of the three OSes by rebooting and selecting the desired partition. However, you can use the Refind app to have a neat bootloader.
Step 5- Install the Refind bootloader
Refind is the graphical interface for your bootloader, which will give you the option of which OS to boot into everytime you restart. This saves you having to remember to hold down the Alt key everytime!
This can be relatively easy or a bit of a pain, depending on your vintage of Mac. Refind will sort your bootloader out, but Apple have added SIP (System Integrity Protection) to Macs and this means that Refind can’t make the changes to the Apple bootloader to get up and running.
To check if you have SIP enabled, boot back into your Mac partition using Alt and bring up a terminal window. Type:
to see if SIP is enabled. If it says “disabled” then it’s simply a matter of double clicking on the refind-install file in your Refind folder. If this is the case, you now have a working Refind install. Skip ahead to Step 6!
If it says “enabled” (which it probably will on most systems) then you’ll need to install Refind from the Recovery Mode, which neatly bypasses SIP. It is also possible to do this by disabling and re-enabling SIP from terminal, but I found this method works for me.
Reboot your Mac and hold down Command + R to boot into recovery mode. From here, select “Utilites”, then “Terminal” from the top menu.
Now you’ll need to get into the directory where you unzipped Refind. Hopefully you remember where it is! The command for this is cd followed by the directory path to the Refind folder.
For me, the directory path was Volumes/Macintosh\ HD/Users/John/Downloads/refind-bin-0.11.4/. Remember that tab will autocomplete valid folders (so you can just type refind then press tab to have the terminal autocomplete the folder name).
(You may need to enter “cd ..” a couple of times to get up to the folder that contains the Volumes directory)
Once you’re in the refind directory, simply type:
Which will install Refind. You may then get a warning about SIP, but it won’t block the installation. You now can exit out of Recovery mode, which should now boot straight into Refind!
Step 6 – Customise Refind (optional)
Now everything is up and running, you can fiddle about with the look and feel of Refind to make it look exactly how you wanted – different icons for the OSes, whole new themes and so forth. I found one handy thing to do is to remove the boot partitions from the list. You can do this by selecting the recycling icon on the second row and removing unwanted icons. If the wrong icon is hidden (I did this with Windows!) go back into this option to unhide it!
You should now (hopefully!) have a Refind controlled triple booting Mac. Enjoy!
As stated, I used a number of resources to get my installation working. Here’s a list of the most useful pages: