GPT Partitioning GPT Partitioning GPT Partitioning GPT Partitioning GUID
Total Page:16
File Type:pdf, Size:1020Kb
GPT Partitioning GUID Partition Table File GUID Partition - Used on Intel IA64 (EFI) Systems System Table - Supports up to 128 Partitions - 64-bit (8 byte) LBA addressing Forensics Partitioning GUID (Globally Unique Identifier) - Uses 128-bit unique identifiers for - Partition Type Digital Forensics Center - Partition Identifier Department of Computer Science and Statics THINK BIG WE DO Required for Boot Partitions U R I - Microsoft Windows on an EFI System - Mac OS X http://www.forensics.cs.uri.edu GPT Partitioning GPT Partitioning 0 Protective MBR 0 Protective MBR Protective MBR Decimal Hex Primary GPT Header 1 Primary GPT Header 1 Primary GPT Header - Allows compatibility with older systems 2 0 00 Signature “EFI PART” 2 - Single MBR Partition of type 0xEE Partition Entries 8 08 Version Partition Entries 34 12 0C GPT Size in Bytes (92) 34 Primary GPT Header 16 10 CRC32 Checksum of GPT Header Partition 1 Partition 1 - General Layout of the disk 20 14 Reserved 24 18 LBA of Current GPT Structure Partition Entries Partition 2 32 20 LBA of Other GPT Structure Partition 2 - Description of Each Partition 40 28 Start LBA of Partition Area 48 30 End LBA of Partition Area Partition Area . Other Partitions 56 38 Disk GUID Other Partitions Backup Partition Entries . 72 48 Start LBA of Partition Entries . Secondary GPT Header 80 50 Number of Entries in Partition Table EOD-33 Secondary Partition 84 54 Size of Each Partition Table Entry EOD-33 Secondary Partition - Backup Copies Entries Entries EOD-1 88 58 CRC32 Checksum of Partition Table EOD-1 Secondary GPT Header Secondary GPT Header - Last Sectors of Disk End of Disk (EOD) 92 5C Reserved (EOD) GPT Partitioning 0 Protective MBR Decimal Hex Partition Entry in Partition Table (128 bytes) 1 Primary GPT Header 0 00 Partition Type GUID (128-bits) 2 16 10 Unique Partition GUID (128-bits) Partition Entries GUID Partition Table 32 20 Starting LBA of Partition 34 40 28 Ending LBA of Partition Partition 1 48 30 Partition Attributes Partitioning 56 38 Partition Name in Unicode Partition 2 32 sectors = 128 entries ÷ 4 entries per sector . Digital Forensics Center Other Partitions THINK BIG WE DO . Department of Computer Science and Statics Microsoft Windows limits EOD-33 the number of partition Secondary Partition Entries U R I table entries to 128. EOD-1 Secondary GPT Header (EOD) http://www.forensics.cs.uri.edu.