Format: 90-minute live online session
Level: Foundational to Intermediate
Instructor: James Eichbaum
Language: English
Price: $195 ex VAT per participant (non-binding expression of interest)
Mode: Live + Interactive Q&A
Includes:
- Live technical walkthrough
- Hex-level analysis using HxD
- Downloadable forensic disk images
- Guided recovery lab
- Instructor-led Q&A
Overview
This focused micro-course offers a hands-on introduction to GPT partition structures in forensic investigations.
Ideal for examiners, analysts, or IT professionals with basic hex familiarity, this live session covers how modern disks are structured using the GUID Partition Table (GPT)
and how those structures can be validated, analyzed, and repaired in forensic contexts.
Topics Covered
- The Protective MBR: legacy compatibility and how to identify it
- GPT Header: structure, CRC validation, and GUID interpretation
- Partition Entry Array: layout, parsing entries, and practical relevance
- When and how to rebuild or repair damaged partition tables
- Lab: Step-by-step recovery of a corrupted GPT from disk image
Learning Outcomes
By the end of this session, participants will be able to:
- Identify and interpret key GPT components: Protective MBR, GPT Header, and Partition Entry Array
- Validate integrity using CRC checks and GUID decoding techniques
- Apply recovery workflows to rebuild damaged or missing GPT structures
- Confidently explain GPT findings in forensic reports, or in court settings if required
Who Should Attend?
- Digital forensic examiners
- Incident responders
- Law enforcement or defense professionals
- Anyone reviewing raw disk data in a forensic capacity
Registration is now open.
This is a non-binding expression of interest. We’ll contact you with more details and scheduling options.
