Computer Systems Forensic Analysis

Applied Cryptography Robust Software Quantum Safety Machine Learning Applied to Security Analysis and Exploration of Vulnerabilities Computer Systems Forensic Analysis Reverse Engineering Identification, Authentication and Authorization Secure Execution Environments Direito da Organização e da Segurança

Computer Systems Forensic Analysis
Overview of Cybercrime
Introduction to Digital Forensics
Obtaining Evidences
Data Organization
Storage Devices
Volumes and Partitions
RAM Analysis
Mobile Forensics
Open Source INTelligence
Documentation and Reporting

Powered by GitBook

On this page

Common Partition Tables (GPT)

PreviousRemovable Storage NextCommon Partition Tables (BSD)

Last updated 10 months ago

GPT Partitions

GUID – globally unique identifiers.
introduced on a system with 64-bit Intel Itanium (IA64) processors.
is part of the Unified Extensible Firmware Interface (UEFI) standard.
- replaces the BIOS and can also be used in PCs.
drives are identified with globally unique identifiers (GUID).
uses 64-bit LBA.
Microsoft added support since Windows 2008.

Structure:

protective MBR – to prevent non-compatible OS from formatting the drive.
GPT header – starts on sector 1, defines the size and location of the partition table, and has also a checksum.
partition table – supports up to 128 partitions, and contains begin and end sectors, type, name, attributes, and GUID values (128 bits).
partition area – the main drive area.
backup area – located in the last sectors of the drive.