GPT Partitioning

GUID Partition Table File GUID Partition - Used on IA64 (EFI) Systems System Table - Supports up to 128 Partitions - 64-bit (8 ) LBA addressing Forensics Partitioning GUID (Globally Unique Identifier) - Uses 128-bit unique identifiers for - Digital Forensics Center - Partition Identifier Department of Computer Science and Statics THINK BIG WE DO Required for Boot Partitions U R I - on an EFI System - Mac OS X http://www.forensics.cs.uri.edu

GPT Partitioning GPT Partitioning

0 Protective MBR 0 Protective MBR Protective MBR Decimal Hex Primary GPT Header 1 Primary GPT Header 1 Primary GPT Header - Allows compatibility with older systems 2 0 00 Signature “EFI PART” 2 - Single MBR Partition of type 0xEE Partition Entries 8 08 Version Partition Entries 34 12 0C GPT Size in (92) 34 Primary GPT Header 16 10 CRC32 Checksum of GPT Header Partition 1 Partition 1 - General Layout of the disk 20 14 Reserved 24 18 LBA of Current GPT Structure Partition Entries Partition 2 32 20 LBA of Other GPT Structure Partition 2 - Description of Each Partition 40 28 Start LBA of Partition Area 48 30 End LBA of Partition Area Partition Area ...... Other Partitions 56 38 Disk GUID Other Partitions Backup Partition Entries . . . 72 48 Start LBA of Partition Entries . . . Secondary GPT Header 80 50 Number of Entries in Partition Table EOD-33 Secondary Partition 84 54 Size of Each Partition Table Entry EOD-33 Secondary Partition - Backup Copies Entries Entries EOD-1 88 58 CRC32 Checksum of Partition Table EOD-1 Secondary GPT Header Secondary GPT Header - Last Sectors of Disk End of Disk (EOD) 92 5C Reserved (EOD)

GPT Partitioning

0 Protective MBR Decimal Hex Partition Entry in Partition Table (128 bytes) 1 Primary GPT Header 0 00 Partition Type GUID (128-bits) 2 16 10 Unique Partition GUID (128-bits) Partition Entries GUID Partition Table 32 20 Starting LBA of Partition 34 40 28 Ending LBA of Partition Partition 1 48 30 Partition Attributes Partitioning 56 38 Partition Name in Partition 2

32 sectors = 128 entries ÷ 4 entries per sector . . . Digital Forensics Center Other Partitions THINK BIG WE DO . . . Department of Computer Science and Statics Microsoft Windows limits EOD-33 the number of partition Secondary Partition Entries U R I table entries to 128. EOD-1 Secondary GPT Header (EOD) http://www.forensics.cs.uri.edu