{"id":918,"date":"2024-11-22T16:04:21","date_gmt":"2024-11-22T16:04:21","guid":{"rendered":"https:\/\/elusivedata.io\/?p=918"},"modified":"2025-07-18T18:04:38","modified_gmt":"2025-07-18T18:04:38","slug":"1-2","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/nb\/1-2\/","title":{"rendered":"Forst\u00e5 den beskyttende MBR-en p\u00e5 GPT-partisjonerte disker. Del 1."},"content":{"rendered":"<h1 class=\"wp-block-heading\" id=\"h-introduction\">Innledning<\/h1>\n\n\n\n<p>I denne serien av blogginnlegg vil jeg dykke dypt ned i GUID Partition Table Schema. M\u00e5let er \u00e5 gi en klar forst\u00e5else av GPT-skjemaet og hvordan det gj\u00f8r det mulig for kriminalteknikere \u00e5 analysere og gjenopprette data fra moderne lagringsenheter p\u00e5 en n\u00f8yaktig m\u00e5te. GPTs st\u00f8tte for st\u00f8rre disker, flere partisjoner og forbedrede dataintegritetsfunksjoner, for eksempel redundans og CRC-beskyttelse, sikrer at etterforskere kan f\u00e5 tilgang til og verifisere alle n\u00f8dvendige data. GPTs kompatibilitet med moderne operativsystemer og UEFI-fastvare forbedrer dessuten muligheten til \u00e5 utf\u00f8re omfattende kriminaltekniske unders\u00f8kelser, noe som gj\u00f8r den uunnv\u00e6rlig for \u00e5 avdekke digitale bevis og sikre integriteten og p\u00e5liteligheten til de kriminaltekniske funnene.&nbsp;<\/p>\n\n\n\n<p>Jeg begynner med Protective MBR og hvordan den skiller seg fra den tradisjonelle MBR-en som brukes med eldre stasjoner i BIOS. Deretter tar jeg deg gjennom GPT-overskriften og deretter GPT Entry Array. Til slutt vil jeg dele noen avsluttende tanker og tips om hvordan du forklarer disse konseptene til en lekmann, for eksempel n\u00e5r du vitner foran en dommer eller jury.<\/p>\n\n\n\n<p>N\u00e5r du har lest denne serien, vil du til slutt ikke ha noen problemer med \u00e5 takle en CTF-utfordring p\u00e5 CTF-plattformen v\u00e5r.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"h-part-1\">DEL 1<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-the-protective-mbr\">Den beskyttende MBR-en<\/h2>\n\n\n\n<p>Master Boot Record (MBR) fra et eldre synspunkt ga oss et veikart for \u00e5 finne opptil fire prim\u00e6re partisjoner p\u00e5 en harddisk. Hver 16-byte partisjonspost ledet oss til plasseringen av den aktuelle partisjonen, enten den var FAT32 eller NTFS. Den gamle MBR hadde imidlertid begrensninger, blant annet<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>En st\u00f8rrelsesbegrensning p\u00e5 2 TB.<\/li>\n\n\n\n<li>Begrenset til 4 prim\u00e6re partisjoner; hvis det er behov for flere, vil en av de prim\u00e6re partisjonene bli utpekt som en utvidet partisjon.<\/li>\n\n\n\n<li>Et enkelt feilpunkt siden MBR, som inkluderer partisjonstabellen, var plassert i sektor 0 uten sikkerhetskopi.<\/li>\n<\/ul>\n\n\n\n<p>LBA 0 (logisk sektor 0) p\u00e5 en GPT-harddisk inneholder det som kalles en Protective MBR i stedet for en eldre MBR. Tenk p\u00e5 Protective MBR som et skilt ved inngangen til biblioteket som forteller alle: \"Hei, dette biblioteket bruker et nytt og forbedret system n\u00e5. Ikke bruk den gamle metoden, for den fungerer ikke her.\"<\/p>\n\n\n\n<p>I stedet for \u00e5 inneholde plasseringen til bare fire prim\u00e6re partisjoner p\u00e5 disken, markerer Protective MBR hele disken som brukt av GPT, noe som indikerer for eldre systemer at disken er fullt utnyttet. Protective MBR finnes bare for \u00e5 sikre bakoverkompatibilitet. Den inneholder KUN \u00e9n partisjonsoppf\u00f8ring, som markerer disken og forhindrer at eldre verkt\u00f8y feiltolker diskstrukturen.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-structure-of-the-protective-mbr\">Strukturen til den beskyttende MBR-enheten<\/h3>\n\n\n\n<p>De f\u00f8rste 440 byte i den beskyttende MBR-en inneholder oppstartskode som ikke brukes av UEFI-systemer. Den ignoreres.&nbsp;&nbsp;<\/p>\n\n\n\n<p>Nedenfor ser du et hypotetisk oppsett av en disk med en fersk Windows 10-installasjon som bare har \u00e9n partisjon opprettet under installasjonsprosessen, C: -stasjonen. UEFI-systempartisjonen opprettes automatisk og skjules for brukeren, og Microsoft Reserved Partition opprettes ogs\u00e5 under installasjonen og skjules for brukeren.&nbsp;<\/p>\n\n\n\n<p>Her ser vi Protective MBR p\u00e5 LBA 0, som peker til GPT Header p\u00e5 LBA 1.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img fetchpriority=\"high\" decoding=\"async\" width=\"740\" height=\"164\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1.png\" alt=\"\" class=\"wp-image-924\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1.png 740w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1-600x133.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1-300x66.png 300w\" sizes=\"(max-width: 740px) 100vw, 740px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-hex-layout-of-the-protective-mbr\">Hex-layout for den beskyttende MBR-enheten<\/h3>\n\n\n\n<p>Her er et eksempel p\u00e5 hex-layout for Protective MBR:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"751\" height=\"650\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1.png\" alt=\"\" class=\"wp-image-925\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1.png 751w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1-600x519.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1-300x260.png 300w\" sizes=\"(max-width: 751px) 100vw, 751px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"749\" height=\"159\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1.png\" alt=\"\" class=\"wp-image-926\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1.png 749w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1-600x127.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1-300x64.png 300w\" sizes=\"(max-width: 749px) 100vw, 749px\" \/><\/figure>\n\n\n\n<p>Som nevnt tidligere, brukes ikke de f\u00f8rste 440 byte med oppstartskode av UEFI-systemer. Du kan se at disse f\u00f8rste 440 byte er nullet ut p\u00e5 noen systemer. Her er Protective MBR fra arbeidsstasjonen jeg bruker til \u00e5 skrive denne bloggen, der jeg bruker en Samsung 1 TB NVME-disk:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"811\" height=\"814\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2.png\" alt=\"\" class=\"wp-image-928\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2.png 811w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-300x300.png 300w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-100x100.png 100w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-600x602.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-150x150.png 150w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-768x771.png 768w\" sizes=\"(max-width: 811px) 100vw, 811px\" \/><\/figure>\n\n\n\n<p>Som du kan se, inneholder hele Protective MBR i dette tilfellet nuller, bortsett fra de fire byte som ligger ved offset 440 (som ikke brukes), den f\u00f8rste \"primary partition entry\" (som bare peker p\u00e5 LBA 1 - GPT Header), og oppstartssignaturen som ligger ved de to siste byte i sektoren (0x55AA).&nbsp;<\/p>\n\n\n\n<p>La oss n\u00e5 se n\u00e6rmere p\u00e5 den ene partisjonsposten som finnes i en Protective MBR:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"748\" height=\"647\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3.png\" alt=\"\" class=\"wp-image-929\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3.png 748w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3-600x519.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3-300x259.png 300w\" sizes=\"(max-width: 748px) 100vw, 748px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"752\" height=\"138\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2.png\" alt=\"\" class=\"wp-image-930\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2.png 752w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2-600x110.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2-300x55.png 300w\" sizes=\"(max-width: 752px) 100vw, 752px\" \/><\/figure>\n\n\n\n<p>Den f\u00f8rste byten i partisjonsposten er satt til 0x00 for \u00e5 indikere at det ikke er en oppstartbar partisjon. I en tradisjonell MBR vil denne verdien enten v\u00e6re 0x00 (ikke oppstartbar) eller 0x80 (oppstartbar). De neste tre byte representerer <strong>Starter CHS <\/strong>plassering (Cylinder\/Head\/Sector), som vil tilsvare 4-byte-verdien i <strong>Starter LBA<\/strong> feltet ved byteoffset 8. Start CHS-verdien blir satt til <strong>0x000200<\/strong> som, n\u00e5r den brytes ned og konverteres til en LBA-adresse, er 1.<\/p>\n\n\n\n<p>F\u00f8lgende verdi p\u00e5 \u00e9n byte er satt til <strong>0xEE<\/strong> for OS-typen: <strong>GPT Beskyttende<\/strong>. Tre-byte-verdien ved offset 5 settes til CHS-adressen til den siste logiske blokken p\u00e5 disken. Start-LBA-en, som f\u00f8rer oss til GPT-partisjonshodet, ligger ved offset 8 i fire byte, og verdien blir satt til <strong>0x01000000<\/strong> (eller LBA 1 ved lesing av little endian). De siste 4 byte i posten ved offset 12 representerer st\u00f8rrelsen p\u00e5 disken minus \u00e9n. Den er satt til <strong>0xFFFFFFFFFF<\/strong> hvis st\u00f8rrelsen p\u00e5 disken er for stor til \u00e5 bli representert i dette feltet, noe som mest sannsynlig er tilfelle.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-repairing-a-protective-mrb\">Reparasjon av en beskyttende MRB<\/h3>\n\n\n\n<p>Hvis MBR-en ble \u00f8delagt, mistet eller slettet, kan du erstatte sektor 0 ved \u00e5 kopiere den beskyttende MBR-en fra en annen stasjon. Du kan ogs\u00e5 opprette en fra bunnen av ved \u00e5 la 0x00 st\u00e5 fra offset 0 til og med 446, og deretter opprette en generisk partisjonspost som peker til LBA 1, og s\u00f8rge for at 0xEE finnes ved offset 4 for \u00e5 indikere GPT Protective OS-typen. Til slutt plasserer du oppstartssignaturen (0x55AA) i de to siste byte i sektoren.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-generic-entry\"><em>Generisk oppf\u00f8ring<\/em><\/h4>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>446<\/td><td>447<\/td><td>448<\/td><td>449<\/td><td>450<\/td><td>451<\/td><td>452<\/td><td>453<\/td><td>454<\/td><td>455<\/td><td>456<\/td><td>457<\/td><td>458<\/td><td>459<\/td><td>460<\/td><td>461<\/td><\/tr><tr><td>00<\/td><td>00<\/td><td>02<\/td><td>00<\/td><td>EE<\/td><td>FF<\/td><td>FF<\/td><td>FF<\/td><td>01<\/td><td>00<\/td><td>00<\/td><td>00<\/td><td>FF<\/td><td>FF<\/td><td>FF<\/td><td>FF<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-boot-signature\"><em>Boot Signature<\/em><\/h4>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>510<\/td><td>511<\/td><\/tr><tr><td>55<\/td><td>AA<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>F\u00f8lgende vil v\u00e6re tilstrekkelig for en gjenoppbygd Protective MBR:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"508\" height=\"449\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD4.png\" alt=\"\" class=\"wp-image-932\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD4.png 508w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD4-300x265.png 300w\" sizes=\"(max-width: 508px) 100vw, 508px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-conclusion\">Konklusjon<\/h2>\n\n\n\n<p>I denne f\u00f8rste delen utforsket vi Protective MBR og dens avgj\u00f8rende rolle for \u00e5 sikre bakoverkompatibilitet med eldre systemer. Vi unders\u00f8kte hvordan Protective MBR markerer hele disken som brukt av GPT, slik at eldre systemer ikke kan feiltolke diskens struktur. Ved \u00e5 forst\u00e5 strukturen og funksjonen til Protective MBR har du n\u00e5 et solid grunnlag for \u00e5 dykke dypere ned i GPT-skjemaet.<\/p>\n\n\n\n<p>N\u00e5r vi g\u00e5r videre, vil vi fokusere p\u00e5 GPT Header, hj\u00f8rnesteinen i GPT-skjemaet som definerer disklayouten og sikrer dataintegritet. I del 2 skal vi bryte ned GPT-headeren og se n\u00e6rmere p\u00e5 hvert enkelt felt og dets betydning. F\u00f8lg med n\u00e5r vi fortsetter \u00e5 avdekke kompleksiteten i GPT-skjemaet, slik at du f\u00e5r kunnskapen du trenger for \u00e5 administrere og gjenopprette data fra moderne lagringsenheter p\u00e5 en effektiv m\u00e5te.<\/p>\n\n\n\n<p><strong>\u00d8nsker du \u00e5 dykke dypere ned i GPT-strukturen?<br><\/strong><br>I <a class=\"\" href=\"https:\/\/elusivedata.io\/nb\/2-2\/\"><strong>Del 2<\/strong><\/a>bryter vi ned <strong>GPT-overskrift<\/strong> og forklare hvordan den sikrer dataintegritet p\u00e5 tvers av disken.<br>S\u00e5 i <a class=\"\" href=\"https:\/\/elusivedata.io\/nb\/3-2\/\"><strong>Del 3<\/strong><\/a>utforsker vi <strong>GPT Partition Entry Array<\/strong> og hva kriminalteknikere trenger \u00e5 vite n\u00e5r de rekonstruerer partisjonstabeller.<\/p>","protected":false},"excerpt":{"rendered":"<p>Utforsk rollen til den beskyttende MBR-en p\u00e5 GPT-partisjonerte disker. Denne veiledningen tar for seg form\u00e5let, funksjonaliteten og viktigheten i digital kriminalteknisk etterforskning.<\/p>","protected":false},"author":1,"featured_media":748,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"blog-post","footnotes":""},"categories":[19],"tags":[],"class_list":["post-918","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digital-forensics"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.3 (Yoast SEO v27.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Understanding the Protective MBR in GPT-Partitioned Disks. Part 1. - Elusive Data<\/title>\n<meta name=\"description\" content=\"Learn how the Protective MBR works in GPT-partitioned disks and why it matters in digital forensic investigations. Part 1 of our deep-dive series.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/nb\/1-2\/\" \/>\n<meta property=\"og:locale\" content=\"nb_NO\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Understanding the Protective MBR in GPT-Partitioned Disks.\" \/>\n<meta property=\"og:description\" content=\"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/nb\/1-2\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-22T16:04:21+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46-1024x675.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Understanding the Protective MBR in GPT-Partitioned Disks.\" \/>\n<meta name=\"twitter:description\" content=\"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png\" \/>\n<meta name=\"twitter:label1\" content=\"Skrevet av\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Ansl. lesetid\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutter\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1.\",\"datePublished\":\"2024-11-22T16:04:21+00:00\",\"dateModified\":\"2025-07-18T18:04:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\"},\"wordCount\":1133,\"commentCount\":5,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"articleSection\":[\"Digital Forensics\"],\"inLanguage\":\"nb-NO\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\",\"name\":\"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1. - Elusive Data\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"datePublished\":\"2024-11-22T16:04:21+00:00\",\"dateModified\":\"2025-07-18T18:04:38+00:00\",\"description\":\"Learn how the Protective MBR works in GPT-partitioned disks and why it matters in digital forensic investigations. Part 1 of our deep-dive series.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#breadcrumb\"},\"inLanguage\":\"nb-NO\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"nb-NO\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"width\":2662,\"height\":1754,\"caption\":\"Close-up of a hard disk drive, used to illustrate GPT disk structure in digital forensics.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"nb-NO\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nb-NO\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nb-NO\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/nb\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Forst\u00e5 den beskyttende MBR-en p\u00e5 GPT-partisjonerte disker. Del 1. - Unnvikende data","description":"Finn ut hvordan den beskyttende MBR-en fungerer p\u00e5 GPT-partisjonerte disker, og hvorfor den er viktig i digital kriminalteknisk etterforskning. Del 1 av v\u00e5r serie med dypdykk.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/nb\/1-2\/","og_locale":"nb_NO","og_type":"article","og_title":"Understanding the Protective MBR in GPT-Partitioned Disks.","og_description":"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.","og_url":"https:\/\/elusivedata.io\/nb\/1-2\/","og_site_name":"Elusive Data","article_published_time":"2024-11-22T16:04:21+00:00","article_modified_time":"2025-07-18T18:04:38+00:00","og_image":[{"width":1024,"height":675,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46-1024x675.png","type":"image\/png"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_title":"Understanding the Protective MBR in GPT-Partitioned Disks.","twitter_description":"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.","twitter_image":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","twitter_misc":{"Skrevet av":"James Eichbaum","Ansl. lesetid":"7 minutter"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/1-2\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/1-2\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1.","datePublished":"2024-11-22T16:04:21+00:00","dateModified":"2025-07-18T18:04:38+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/1-2\/"},"wordCount":1133,"commentCount":5,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","articleSection":["Digital Forensics"],"inLanguage":"nb-NO","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/1-2\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/1-2\/","url":"https:\/\/elusivedata.io\/1-2\/","name":"Forst\u00e5 den beskyttende MBR-en p\u00e5 GPT-partisjonerte disker. Del 1. - Unnvikende data","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","datePublished":"2024-11-22T16:04:21+00:00","dateModified":"2025-07-18T18:04:38+00:00","description":"Finn ut hvordan den beskyttende MBR-en fungerer p\u00e5 GPT-partisjonerte disker, og hvorfor den er viktig i digital kriminalteknisk etterforskning. Del 1 av v\u00e5r serie med dypdykk.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/1-2\/#breadcrumb"},"inLanguage":"nb-NO","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/1-2\/"]}]},{"@type":"ImageObject","inLanguage":"nb-NO","@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","width":2662,"height":1754,"caption":"Close-up of a hard disk drive, used to illustrate GPT disk structure in digital forensics."},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/1-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1."}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"ElusiveData","description":"Fremragende oppl\u00e6ring og r\u00e5dgivning innen digital etterforskning","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"nb-NO"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"ElusiveData","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"nb-NO","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"nb-NO","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/nb\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/posts\/918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/comments?post=918"}],"version-history":[{"count":7,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/posts\/918\/revisions"}],"predecessor-version":[{"id":7450,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/posts\/918\/revisions\/7450"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/media\/748"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/media?parent=918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/categories?post=918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/tags?post=918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}