{"id":918,"date":"2024-11-22T16:04:21","date_gmt":"2024-11-22T16:04:21","guid":{"rendered":"https:\/\/elusivedata.io\/?p=918"},"modified":"2025-07-18T18:04:38","modified_gmt":"2025-07-18T18:04:38","slug":"1-2","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/fr\/1-2\/","title":{"rendered":"Comprendre le MBR de protection dans les disques partitionn\u00e9s en GPT. Partie 1."},"content":{"rendered":"<h1 class=\"wp-block-heading\" id=\"h-introduction\">Introduction<\/h1>\n\n\n\n<p>Dans cette s\u00e9rie d'articles de blog, je vais me plonger dans le sch\u00e9ma de la table de partition GUID. Mon objectif est de fournir une compr\u00e9hension claire du sch\u00e9ma GPT et de la mani\u00e8re dont il permet aux enqu\u00eateurs d'analyser et de r\u00e9cup\u00e9rer avec pr\u00e9cision les donn\u00e9es des p\u00e9riph\u00e9riques de stockage modernes. La prise en charge par GPT de disques plus grands, de partitions multiples et de fonctions d'int\u00e9grit\u00e9 des donn\u00e9es am\u00e9lior\u00e9es, telles que la redondance et la protection CRC, permet aux enqu\u00eateurs d'acc\u00e9der \u00e0 toutes les donn\u00e9es n\u00e9cessaires et de les v\u00e9rifier. En outre, la compatibilit\u00e9 du GPT avec les syst\u00e8mes d'exploitation contemporains et les microprogrammes UEFI am\u00e9liore la capacit\u00e9 \u00e0 effectuer des examens m\u00e9dico-l\u00e9gaux complets, ce qui le rend indispensable pour d\u00e9couvrir des preuves num\u00e9riques et garantir l'int\u00e9grit\u00e9 et la fiabilit\u00e9 des r\u00e9sultats m\u00e9dico-l\u00e9gaux.&nbsp;<\/p>\n\n\n\n<p>Je commencerai par le MBR protecteur et la mani\u00e8re dont il diff\u00e8re du MBR traditionnel utilis\u00e9 avec les anciens disques dans le BIOS. Ensuite, je vous pr\u00e9senterai l'en-t\u00eate GPT, puis la matrice d'entr\u00e9e GPT. Enfin, je vous ferai part de mes conclusions et de mes conseils pour expliquer ces concepts \u00e0 un profane, par exemple lors d'un t\u00e9moignage devant un juge ou un jury.<\/p>\n\n\n\n<p>En fin de compte, apr\u00e8s avoir lu cette s\u00e9rie, vous n'aurez aucun mal \u00e0 relever un d\u00e9fi CTF sur notre plateforme CTF.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"h-part-1\">PARTIE 1<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-the-protective-mbr\">Le MBR protecteur<\/h2>\n\n\n\n<p>Le Master Boot Record (MBR) nous a fourni une feuille de route pour localiser jusqu'\u00e0 quatre partitions primaires sur un disque dur. Chaque entr\u00e9e de partition de 16 octets nous guidait vers l'emplacement de cette partition, qu'elle soit FAT32 ou NTFS. Cependant, l'ancien MBR pr\u00e9sentait des limitations, notamment, mais pas uniquement :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Une limite de taille de 2 To.<\/li>\n\n\n\n<li>Limit\u00e9 \u00e0 4 partitions primaires ; si plus de partitions sont n\u00e9cessaires, l'une de ces partitions primaires sera d\u00e9sign\u00e9e comme partition \u00e9tendue.<\/li>\n\n\n\n<li>Un seul point de d\u00e9faillance puisque le MBR, qui comprend la table de partition, \u00e9tait situ\u00e9 dans le secteur 0 sans aucune sauvegarde.<\/li>\n<\/ul>\n\n\n\n<p>Le LBA 0 (secteur logique 0) d'un disque dur GPT contient ce que l'on appelle un MBR de protection plut\u00f4t qu'un MBR h\u00e9rit\u00e9. Imaginez le MBR de protection comme un panneau \u00e0 l'entr\u00e9e de la biblioth\u00e8que qui dit \u00e0 tout le monde : \"H\u00e9, cette biblioth\u00e8que utilise un syst\u00e8me nouveau et am\u00e9lior\u00e9. N'utilisez pas l'ancienne m\u00e9thode car elle ne fonctionnera pas ici\".<\/p>\n\n\n\n<p>Au lieu de contenir l'emplacement des quatre partitions primaires du disque, le MBR de protection marque l'ensemble du disque comme \u00e9tant utilis\u00e9 par GPT, ce qui indique aux syst\u00e8mes plus anciens que le disque est enti\u00e8rement utilis\u00e9. Le MBR de protection n'existe que pour des raisons de compatibilit\u00e9 ascendante. Il contient UNIQUEMENT une entr\u00e9e de partition, qui marque le disque et emp\u00eache les anciens outils de mal interpr\u00e9ter la structure du disque.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-structure-of-the-protective-mbr\">Structure du MBR de protection<\/h3>\n\n\n\n<p>Les 440 premiers octets du MBR de protection contiennent un code de d\u00e9marrage qui n'est pas utilis\u00e9 par les syst\u00e8mes UEFI. Il est ignor\u00e9.&nbsp;&nbsp;<\/p>\n\n\n\n<p>Voici une disposition hypoth\u00e9tique d'un disque avec une installation r\u00e9cente de Windows 10 n'ayant qu'une seule partition cr\u00e9\u00e9e pendant le processus d'installation, le lecteur C :. La partition syst\u00e8me UEFI est automatiquement cr\u00e9\u00e9e et cach\u00e9e \u00e0 l'utilisateur, et la partition r\u00e9serv\u00e9e Microsoft est \u00e9galement cr\u00e9\u00e9e lors de l'installation et cach\u00e9e \u00e0 l'utilisateur.&nbsp;<\/p>\n\n\n\n<p>Ici, nous pouvons voir le MBR de protection r\u00e9sidant au LBA 0, qui pointe vers l'en-t\u00eate GPT au LBA 1.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img fetchpriority=\"high\" decoding=\"async\" width=\"740\" height=\"164\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1.png\" alt=\"\" class=\"wp-image-924\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1.png 740w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1-600x133.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1-300x66.png 300w\" sizes=\"(max-width: 740px) 100vw, 740px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-hex-layout-of-the-protective-mbr\">Disposition hexagonale du MBR de protection<\/h3>\n\n\n\n<p>Voici un exemple d'agencement hexad\u00e9cimal du MBR de protection :<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"751\" height=\"650\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1.png\" alt=\"\" class=\"wp-image-925\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1.png 751w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1-600x519.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1-300x260.png 300w\" sizes=\"(max-width: 751px) 100vw, 751px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"749\" height=\"159\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1.png\" alt=\"\" class=\"wp-image-926\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1.png 749w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1-600x127.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1-300x64.png 300w\" sizes=\"(max-width: 749px) 100vw, 749px\" \/><\/figure>\n\n\n\n<p>Comme indiqu\u00e9 pr\u00e9c\u00e9demment, les 440 premiers octets du code de d\u00e9marrage ne sont pas utilis\u00e9s par les syst\u00e8mes UEFI. Ces 440 premiers octets peuvent \u00eatre mis \u00e0 z\u00e9ro sur certains syst\u00e8mes. Voici le MBR de protection de la station de travail que j'utilise pour \u00e9crire ce blog, o\u00f9 j'utilise un disque NVME Samsung de 1 To :<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"811\" height=\"814\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2.png\" alt=\"\" class=\"wp-image-928\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2.png 811w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-300x300.png 300w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-100x100.png 100w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-600x602.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-150x150.png 150w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-768x771.png 768w\" sizes=\"(max-width: 811px) 100vw, 811px\" \/><\/figure>\n\n\n\n<p>Comme vous pouvez le constater, l'int\u00e9gralit\u00e9 du MBR de protection contient dans ce cas des z\u00e9ros, \u00e0 l'exception des quatre octets situ\u00e9s \u00e0 l'offset 440 (qui ne sont pas utilis\u00e9s), de la premi\u00e8re \"entr\u00e9e de partition primaire\" (qui pointe simplement vers le LBA 1 - l'en-t\u00eate GPT) et de la signature de d\u00e9marrage situ\u00e9e sur les deux derniers octets du secteur (0x55AA).&nbsp;<\/p>\n\n\n\n<p>Examinons maintenant de plus pr\u00e8s l'entr\u00e9e de partition qui existe dans un MBR de protection :<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"748\" height=\"647\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3.png\" alt=\"\" class=\"wp-image-929\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3.png 748w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3-600x519.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3-300x259.png 300w\" sizes=\"(max-width: 748px) 100vw, 748px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"752\" height=\"138\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2.png\" alt=\"\" class=\"wp-image-930\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2.png 752w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2-600x110.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2-300x55.png 300w\" sizes=\"(max-width: 752px) 100vw, 752px\" \/><\/figure>\n\n\n\n<p>Le premier octet de l'entr\u00e9e de la partition est fix\u00e9 \u00e0 0x00 pour indiquer qu'il ne s'agit pas d'une partition amor\u00e7able. Dans un MBR traditionnel, cette valeur serait soit 0x00 (non amor\u00e7able), soit 0x80 (amor\u00e7able). Les trois octets suivants repr\u00e9sentent le <strong>D\u00e9marrage de la CHS <\/strong>(Cylindre\/T\u00eate\/Secteur), qui correspondra \u00e0 la valeur de 4 octets dans le fichier <strong>D\u00e9marrage LBA<\/strong> au niveau de l'octet 8. La valeur initiale du SHC est fix\u00e9e \u00e0 <strong>0x000200<\/strong> qui, une fois d\u00e9compos\u00e9e et convertie en adresse LBA, est \u00e9gale \u00e0 1.<\/p>\n\n\n\n<p>La valeur suivante d'un octet est fix\u00e9e \u00e0 <strong>0xEE<\/strong> pour le type d'OS : <strong>Protection GPT<\/strong>. La valeur de trois octets au d\u00e9calage 5 est fix\u00e9e \u00e0 l'adresse CHS du dernier bloc logique sur le disque. Le LBA de d\u00e9part, qui nous am\u00e8ne \u00e0 l'en-t\u00eate de partition GPT, est situ\u00e9 \u00e0 l'offset 8 pour quatre octets et sa valeur sera fix\u00e9e \u00e0 <strong>0x01000000<\/strong> (ou LBA 1 en lecture little endian). Les 4 derniers octets de l'enregistrement \u00e0 l'offset 12 repr\u00e9sentent la taille du disque moins un. Il est d\u00e9fini \u00e0 <strong>0xFFFFFF<\/strong> si la taille du disque est trop importante pour \u00eatre repr\u00e9sent\u00e9e dans ce champ, ce qui est tr\u00e8s probablement le cas.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-repairing-a-protective-mrb\">R\u00e9paration d'une MRB protectrice<\/h3>\n\n\n\n<p>Si le MBR est corrompu, perdu ou effac\u00e9, vous pouvez remplacer le secteur 0 en copiant le MBR de protection d'un autre disque. Vous pouvez \u00e9galement en cr\u00e9er un \u00e0 partir de z\u00e9ro, en laissant 0x00 du d\u00e9calage 0 au 446, puis en cr\u00e9ant une entr\u00e9e de partition g\u00e9n\u00e9rique pointant vers le LBA 1, en vous assurant que 0xEE existe au d\u00e9calage 4 pour indiquer le type de syst\u00e8me d'exploitation protecteur GPT. Enfin, placez la signature de d\u00e9marrage (0x55AA) sur les deux derniers octets du secteur.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-generic-entry\"><em>Entr\u00e9e g\u00e9n\u00e9rique<\/em><\/h4>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>446<\/td><td>447<\/td><td>448<\/td><td>449<\/td><td>450<\/td><td>451<\/td><td>452<\/td><td>453<\/td><td>454<\/td><td>455<\/td><td>456<\/td><td>457<\/td><td>458<\/td><td>459<\/td><td>460<\/td><td>461<\/td><\/tr><tr><td>00<\/td><td>00<\/td><td>02<\/td><td>00<\/td><td>EE<\/td><td>FF<\/td><td>FF<\/td><td>FF<\/td><td>01<\/td><td>00<\/td><td>00<\/td><td>00<\/td><td>FF<\/td><td>FF<\/td><td>FF<\/td><td>FF<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-boot-signature\"><em>Signature des bottes<\/em><\/h4>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>510<\/td><td>511<\/td><\/tr><tr><td>55<\/td><td>AA<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Les \u00e9l\u00e9ments suivants suffiraient pour un MBR protecteur reconstruit :<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"508\" height=\"449\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD4.png\" alt=\"\" class=\"wp-image-932\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD4.png 508w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD4-300x265.png 300w\" sizes=\"(max-width: 508px) 100vw, 508px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-conclusion\">Conclusion<\/h2>\n\n\n\n<p>Dans ce premier \u00e9pisode, nous avons explor\u00e9 le MBR de protection et son r\u00f4le crucial dans la r\u00e9trocompatibilit\u00e9 avec les anciens syst\u00e8mes. Nous avons examin\u00e9 comment le MBR de protection marque l'ensemble du disque comme \u00e9tant utilis\u00e9 par GPT, emp\u00eachant ainsi les anciens syst\u00e8mes de mal interpr\u00e9ter la structure du disque. En comprenant la structure et la fonction du MBR de protection, vous disposez maintenant d'une base solide pour approfondir le sch\u00e9ma GPT.<\/p>\n\n\n\n<p>Nous allons maintenant nous concentrer sur l'en-t\u00eate GPT, la pierre angulaire du sch\u00e9ma GPT qui d\u00e9finit l'agencement du disque et garantit l'int\u00e9grit\u00e9 des donn\u00e9es. Dans la partie 2, nous d\u00e9composerons l'en-t\u00eate GPT, en examinant chaque champ et sa signification. Restez \u00e0 l'\u00e9coute car nous continuons \u00e0 d\u00e9m\u00ealer les complexit\u00e9s du sch\u00e9ma GPT, ce qui vous permettra d'acqu\u00e9rir les connaissances n\u00e9cessaires pour g\u00e9rer et r\u00e9cup\u00e9rer efficacement les donn\u00e9es des p\u00e9riph\u00e9riques de stockage modernes.<\/p>\n\n\n\n<p><strong>Vous souhaitez approfondir la structure des TPG ?<br><\/strong><br>En <a class=\"\" href=\"https:\/\/elusivedata.io\/fr\/2-2\/\"><strong>Partie 2<\/strong><\/a>Nous d\u00e9composons les <strong>En-t\u00eate GPT<\/strong> et expliquer comment il garantit l'int\u00e9grit\u00e9 des donn\u00e9es sur le disque.<br>Ensuite, dans <a class=\"\" href=\"https:\/\/elusivedata.io\/fr\/3-2\/\"><strong>Troisi\u00e8me partie<\/strong><\/a>, nous explorons les <strong>Tableau d'entr\u00e9e des partitions GPT<\/strong> et ce que les analystes judiciaires doivent savoir lorsqu'ils reconstruisent les tables de partition.<\/p>","protected":false},"excerpt":{"rendered":"<p>D\u00e9couvrez le r\u00f4le du MBR de protection dans les disques partitionn\u00e9s en GPT. Ce guide pr\u00e9sente son objectif, sa fonctionnalit\u00e9 et son importance dans les enqu\u00eates de criminalistique num\u00e9rique.<\/p>","protected":false},"author":1,"featured_media":748,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"blog-post","footnotes":""},"categories":[19],"tags":[],"class_list":["post-918","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digital-forensics"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.3 (Yoast SEO v27.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Understanding the Protective MBR in GPT-Partitioned Disks. Part 1. - Elusive Data<\/title>\n<meta name=\"description\" content=\"Learn how the Protective MBR works in GPT-partitioned disks and why it matters in digital forensic investigations. Part 1 of our deep-dive series.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/fr\/1-2\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Understanding the Protective MBR in GPT-Partitioned Disks.\" \/>\n<meta property=\"og:description\" content=\"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/fr\/1-2\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-22T16:04:21+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46-1024x675.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Understanding the Protective MBR in GPT-Partitioned Disks.\" \/>\n<meta name=\"twitter:description\" content=\"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1.\",\"datePublished\":\"2024-11-22T16:04:21+00:00\",\"dateModified\":\"2025-07-18T18:04:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\"},\"wordCount\":1133,\"commentCount\":5,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"articleSection\":[\"Digital Forensics\"],\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\",\"name\":\"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1. - Elusive Data\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"datePublished\":\"2024-11-22T16:04:21+00:00\",\"dateModified\":\"2025-07-18T18:04:38+00:00\",\"description\":\"Learn how the Protective MBR works in GPT-partitioned disks and why it matters in digital forensic investigations. Part 1 of our deep-dive series.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"width\":2662,\"height\":1754,\"caption\":\"Close-up of a hard disk drive, used to illustrate GPT disk structure in digital forensics.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/fr\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Comprendre le MBR de protection dans les disques partitionn\u00e9s en GPT. Partie 1. - Donn\u00e9es insaisissables","description":"D\u00e9couvrez comment fonctionne le MBR de protection sur les disques partitionn\u00e9s en GPT et pourquoi il est important dans les enqu\u00eates de criminalistique num\u00e9rique. Premi\u00e8re partie de notre s\u00e9rie d'\u00e9tudes approfondies.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/fr\/1-2\/","og_locale":"fr_FR","og_type":"article","og_title":"Understanding the Protective MBR in GPT-Partitioned Disks.","og_description":"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.","og_url":"https:\/\/elusivedata.io\/fr\/1-2\/","og_site_name":"Elusive Data","article_published_time":"2024-11-22T16:04:21+00:00","article_modified_time":"2025-07-18T18:04:38+00:00","og_image":[{"width":1024,"height":675,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46-1024x675.png","type":"image\/png"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_title":"Understanding the Protective MBR in GPT-Partitioned Disks.","twitter_description":"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.","twitter_image":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","twitter_misc":{"\u00c9crit par":"James Eichbaum","Dur\u00e9e de lecture estim\u00e9e":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/1-2\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/1-2\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1.","datePublished":"2024-11-22T16:04:21+00:00","dateModified":"2025-07-18T18:04:38+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/1-2\/"},"wordCount":1133,"commentCount":5,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","articleSection":["Digital Forensics"],"inLanguage":"fr-FR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/1-2\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/1-2\/","url":"https:\/\/elusivedata.io\/1-2\/","name":"Comprendre le MBR de protection dans les disques partitionn\u00e9s en GPT. Partie 1. - Donn\u00e9es insaisissables","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","datePublished":"2024-11-22T16:04:21+00:00","dateModified":"2025-07-18T18:04:38+00:00","description":"D\u00e9couvrez comment fonctionne le MBR de protection sur les disques partitionn\u00e9s en GPT et pourquoi il est important dans les enqu\u00eates de criminalistique num\u00e9rique. Premi\u00e8re partie de notre s\u00e9rie d'\u00e9tudes approfondies.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/1-2\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/1-2\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","width":2662,"height":1754,"caption":"Close-up of a hard disk drive, used to illustrate GPT disk structure in digital forensics."},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/1-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1."}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"Donn\u00e9es insaisissables","description":"L'excellence en mati\u00e8re de formation et de conseil en criminalistique num\u00e9rique","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"Donn\u00e9es insaisissables","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/fr\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/posts\/918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/comments?post=918"}],"version-history":[{"count":7,"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/posts\/918\/revisions"}],"predecessor-version":[{"id":7450,"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/posts\/918\/revisions\/7450"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/media\/748"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/media?parent=918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/categories?post=918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/fr\/wp-json\/wp\/v2\/tags?post=918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}