{"id":920,"date":"2024-11-22T16:06:10","date_gmt":"2024-11-22T16:06:10","guid":{"rendered":"https:\/\/elusivedata.io\/?p=920"},"modified":"2025-07-18T18:04:37","modified_gmt":"2025-07-18T18:04:37","slug":"2-2","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/nb\/2-2\/","title":{"rendered":"GPT del 2. Rollen til GPT-headeren i diskintegritet."},"content":{"rendered":"

Innledning<\/h2>\n\n\n\n

I den f\u00f8rste delen av denne bloggserien utforsket vi Protective MBR og dens rolle i \u00e5 sikre at moderne GPT-partisjonerte disker er kompatible med eldre systemer. Vi gikk i dybden p\u00e5 hvordan Protective MBR fungerer som en barriere for \u00e5 forhindre at eldre systemer feiltolker GPT-disker, og dermed sikrer at hele disken er merket som i bruk av GPT. Denne grunnleggende forst\u00e5elsen danner grunnlaget for et dypdykk i selve hjertet av GUID-partisjonstabellen (GPT) - GPT-headeren.<\/p>\n\n\n\n

I denne andre delen skal vi g\u00e5 gjennom GPT Header, en viktig komponent i GPT-skjemaet som gir viktig informasjon om diskens struktur. Vi g\u00e5r gjennom hvert enkelt felt i GPT-headeren, forklarer dets betydning og hvordan det bidrar til diskens generelle funksjonalitet og integritet. N\u00e5r dette innlegget er ferdig, vil du ha en omfattende forst\u00e5else av GPT-headeren, slik at du trygt kan analysere og manipulere GPT-partisjonerte disker i rettsmedisinske unders\u00f8kelser eller datagjenopprettingsscenarioer.<\/p>\n\n\n\n

Oversikt over GPT-header<\/h2>\n\n\n\n

GPT (GUID Partition Table)-hodet er en viktig komponent i diskens partisjoneringssystem. Den deler disken inn i separate seksjoner, som hver kan lagre forskjellige typer data, for eksempel operativsystemet, personlige filer, programdata eller spill. Disse seksjonene kan v\u00e6re forskjellige stasjoner (for eksempel C:-stasjonen, D:-stasjonen, E:-stasjonen osv.).<\/p>\n\n\n\n

GPT Header inneholder en sikkerhetskopi i enden av disken, p\u00e5 samme m\u00e5te som \u00e5 ha en ekstran\u00f8kkel til bibliotekskatalogen i tilfelle hovedn\u00f8kkelen skulle g\u00e5 tapt eller bli skadet. Dette sikrer at vi kan finne og f\u00e5 tilgang til dataene v\u00e5re selv om noe skulle g\u00e5 galt.<\/p>\n\n\n\n

GPT-headeren angir plasseringen av sikkerhetskopien og plasseringen av GUID Partition Table Entry Array, som er en liste over GPT-partisjonsposter som angir hvor disse seksjonene (partisjonene) befinner seg p\u00e5 disken.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Figur 1: Oppsett av en hypotetisk Windows 10-installasjon med ett volum (n = siste sektor p\u00e5 stasjonen)<\/em><\/p>\n\n\n\n

GPT Header starter med signaturen EFI PART. Resten av verdiene er fordelt i tabellen nedenfor:<\/p>\n\n\n\n

GPT-overskriftsstruktur<\/h2>\n\n\n\n

GPT-headeren starter med signaturen \"EFI PART\". Resten av verdiene er fordelt i tabellen nedenfor:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Kilde: https:\/\/uefi.org\/specs\/UEFI\/2.10\/05_GUID_Partition_Table_Format.html<\/a><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
S\u00e5 langt vil de f\u00f8rste 16 byte i GPT-headeren forbli konstant p\u00e5 tvers av ulike GPT-disker.<\/p>\n\n\n\n
GPT-header CRC<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Nedenfor ser du et eksempel p\u00e5 hvordan du beregner CRC32 for GPT-toppteksten:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Du kan bruke et Python-skript til \u00e5 beregne CRC for isolerte byte:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Python-skriptet finner du p\u00e5 : https:\/\/github.com\/eichbaumj\/Python<\/a><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Python-skriptet tar den resulterende CRC32-verdien og konverterer den til formatet som kreves for GPT-headeren. Den beregnede verdien er i dette tilfellet 0x1B2C37BC. Men for \u00e5 lagre den i feltet i GPT-headeren, leses verdien i little endian: 0xBC372C1B. <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Disk-GUID<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Skjermbildet nedenfor viser GUID uthevet i GPT-overskriften:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
GUID-en er en heksadesimal verdi p\u00e5 16 byte, men hvis du tror at du bare kan kopiere verdiene og skille dem fra hverandre med bindestreker og sette kr\u00f8llparenteser rundt dem, tar du feil. Du ville ende opp med feil verdi.<\/p>\n\n\n\n
Du kan se at HxD tilbyr GUID-konvertering i datainspekt\u00f8ren til h\u00f8yre. Men hvordan skjer det? Hvordan skjer det?
55 BA 55 51 51 2B D8 59 41 BC 1F C4 17 80 0F D7 63<\/p>\n\n\n\n
Bli det:<\/p>\n\n\n\n
{5155BA55-D82B-4159-BC1F-C417800FD763}<\/p>\n\n\n\n
GUID-formatet<\/em><\/h4>\n\n\n\n
XX XX XX XX XX | XX XX | XX XX | XX XX | XX XX | XX XX XX XX XX XX<\/p>\n\n\n\n
55 BA 55 51 | 2B D8 | 59 41 | BC 1F | C4 17 80 0F D7 63<\/p>\n\n\n\n
Det f\u00f8rste settet med fire byte konverteres til little-endian hex: 51 55 BA 55<\/p>\n\n\n\n
Det andre settet p\u00e5 2 byte konverteres til little-endian hex: D8 2B<\/p>\n\n\n\n
Det tredje settet p\u00e5 2 byte konverteres til little-endian hex: 59 41<\/p>\n\n\n\n
De to gjenv\u00e6rende settene med hex-verdier blir st\u00e5ende som de er, big-endian: BC 1F | C4 17 80 0F D7 63<\/p>\n\n\n\n
N\u00e5r alle konverteringene er fullf\u00f8rt, kan vi sette dem sammen ved \u00e5 plassere bindestreker der de skal v\u00e6re, og omslutte det hele med kr\u00f8llete klammer:<\/p>\n\n\n\n
{5155BA55-D82B-4159-BC1F-C417800FD763}<\/p>\n\n\n\n
Vi kan bekrefte at dette er riktig koding av GUID-en ved \u00e5 starte diskpart fra kommandolinjen og se etter diskens uniqueid:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
GPT-partisjonstabell sjekksum CRC<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Vi kan bruke det samme Python-skriptet, men erstatte hex-verdiene med de som finnes i Partition Entry Array. <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Og vi kan se at verdien stemmer overens med det som finnes i GPT-headeren.<\/p>\n\n\n\n
Reparere en GPT-header<\/h2>\n\n\n\n
Ok, n\u00e5 som vi vet hvordan GPT-headeren er strukturert og at det finnes en sikkerhetskopi i den siste sektoren p\u00e5 disken, hvordan g\u00e5r vi frem for \u00e5 reparere GPT-headeren hvis den skulle bli \u00f8delagt eller slettet?<\/p>\n\n\n\n
For \u00e5 reparere GPT Header kopierer du de siste 512 byte fra slutten av disken og limer dem inn i LBA 1 (sektor #2). Merk at det er n\u00f8dvendig med noen f\u00e5 modifikasjoner.<\/p>\n\n\n\n
Nedenfor ser du et eksempel p\u00e5 hvordan GPT-headeren for sikkerhetskopiering ser ut p\u00e5 slutten av en disk:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Vi kan se at noen verdier forblir konstante sammenlignet med den opprinnelige GPT Header. Disse konstantene er uthevet i r\u00f8dt nedenfor:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Det er fire verdier som m\u00e5 endres.<\/p>\n\n\n\n
Den f\u00f8rste er GPT Header CRC, som vi kommer tilbake til. Inntil videre kan disse verdiene nullstilles, ettersom vi m\u00e5 bruke CRC-en som er beregnet etter at vi har endret de andre verdiene, for \u00e5 f\u00e5 den riktige CRC-en igjen.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Den neste er MyLBA-verdien som ligger p\u00e5 offset 24 i 4 byte. Denne verdien peker til plasseringen av GPT-headeren (der den befinner seg for \u00f8yeblikket), og den n\u00e5v\u00e6rende posisjonen er LBA 1 eller 0x010000000000000000000. <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Verdien p\u00e5 8 byte ved offset 32 er verdien som peker oss til plasseringen av GPT-headeren for sikkerhetskopien. Sikkerhetskopien peker for \u00f8yeblikket til originalen, men vi m\u00e5 endre denne verdien slik at den representerer den siste sektoren p\u00e5 disken. Dette skjedde med hex-verdiene som vi nettopp endret i forrige trinn. I dette eksemplet m\u00e5 verdien endres til 0xAFD23B7700000000.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Verdien p\u00e5 8 byte i offset 72 m\u00e5 gjenspeile plasseringen og starten p\u00e5 GPT Partition Entry Array. For \u00f8yeblikket peker sikkerhetskopien av GPT-toppteksten til sikkerhetskopien av denne matrisen. Den faktiske GPT-partisjonsmatrisen skal v\u00e6re p\u00e5 LBA 2. Denne verdien m\u00e5 endres til 0x02000000000000000000.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
N\u00e5r disse tre verdiene er endret, er det p\u00e5 tide \u00e5 beregne CRC32-verdien. <\/p>\n\n\n\n
Den resulterende sjekksummen er:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
S\u00e5 n\u00e5 kan vi erstatte 0x00000000-verdiene ved offset 16 med 0xBC372C1B:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
HxD har en innebygd CRC32-kontrollsumkalkulator under Analyse -> Kontrollsummer. Den resulterende verdien trenger bare \u00e5 legges til som en little-endian-verdi.<\/p>\n\n\n\n
Hvis vi for nysgjerrighetens skyld skulle isolere disse 512 byte for originalen og sikkerhetskopien som vi gjenopprettet, stemmer hashverdiene faktisk overens, noe som indikerer at vi klarte \u00e5 reprodusere den opprinnelige GPT Header ved hjelp av sikkerhetskopien.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Konklusjon<\/h2>\n\n\n\n
Det er viktig \u00e5 forst\u00e5 detaljene i GPT-headeren for alle som jobber med digital kriminalteknikk, datagjenoppretting eller systemadministrasjon. GPT-headeren definerer ikke bare diskens layout og struktur, men sikrer ogs\u00e5 dataintegritet ved hjelp av mekanismer som CRC32-sjekksummer og backup-header. Ved \u00e5 beherske detaljene i GPT-headeren er du bedre rustet til \u00e5 feils\u00f8ke og reparere diskproblemer, noe som sikrer p\u00e5liteligheten og tilgjengeligheten til kritiske data.<\/p>\n\n\n\n
I fortsettelsen av denne serien vil vi fokusere p\u00e5 GPT Partition Table Entry Array. Vi vil unders\u00f8ke hvordan partisjonsoppf\u00f8ringer er strukturert og hvordan de fungerer sammen med GPT Header for \u00e5 opprettholde organiseringen og integriteten til diskpartisjoner. F\u00f8lg med for en omfattende guide om analyse og reparasjon av GPT Partition Table Entry Array, som gir deg ytterligere kunnskap til \u00e5 h\u00e5ndtere GPT-partisjonerte disker p\u00e5 en trygg m\u00e5te.<\/p>\n\n\n\n
Gikk du glipp av del 1?<\/strong><\/p>\n\n\n\n
Begynn fra begynnelsen: Forst\u00e5 den beskyttende MBR-en p\u00e5 GPT-partisjonerte disker (del 1)<\/a> - der vi g\u00e5r gjennom hvordan GPT sikrer bakoverkompatibilitet med eldre systemer.<\/p>\n\n\n\n
Er du klar for neste steg?<\/strong><\/p>\n\n\n\n
Fortsett til Del 3: Navigere i GPT-partisjonens oppf\u00f8ringstabell<\/a> - hvor vi unders\u00f8ker hvordan partisjonsoppf\u00f8ringene er strukturert og hvordan de utfyller GPT Header.<\/p>","protected":false},"excerpt":{"rendered":"
Utforsk den viktige rollen GPT-headeren spiller for \u00e5 opprettholde diskintegriteten. Denne artikkelen gir innsikt i dens struktur, form\u00e5l og relevans i kriminaltekniske unders\u00f8kelser.<\/p>","protected":false},"author":1,"featured_media":579,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[19],"tags":[],"class_list":["post-920","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digital-forensics"],"acf":[],"yoast_head":"\nGPT part 2. The Role of the GPT Header in Disk Integrity. - Elusive Data<\/title>\n<meta name=\"description\" content=\"Explore the role of the GPT Header in maintaining disk integrity and enabling forensic analysis. Part 2 of our series on GUID Partition Table structures for digital investigators.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/nb\/2-2\/\" \/>\n<meta property=\"og:locale\" content=\"nb_NO\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GPT part 2. The Role of the GPT Header in Disk Integrity.\" \/>\n<meta property=\"og:description\" content=\"Explore the role of the GPT Header in maintaining disk integrity and enabling forensic analysis. Part 2 of our series on GUID Partition Table structures for digital investigators.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/nb\/2-2\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-22T16:06:10+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:37+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD2-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1920\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Skrevet av\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Ansl. lesetid\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutter\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"GPT part 2. The Role of the GPT Header in Disk Integrity.\",\"datePublished\":\"2024-11-22T16:06:10+00:00\",\"dateModified\":\"2025-07-18T18:04:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/\"},\"wordCount\":1382,\"commentCount\":2,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD2-scaled.jpg\",\"articleSection\":[\"Digital Forensics\"],\"inLanguage\":\"nb-NO\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/\",\"name\":\"GPT part 2. The Role of the GPT Header in Disk Integrity. - Elusive Data\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD2-scaled.jpg\",\"datePublished\":\"2024-11-22T16:06:10+00:00\",\"dateModified\":\"2025-07-18T18:04:37+00:00\",\"description\":\"Explore the role of the GPT Header in maintaining disk integrity and enabling forensic analysis. Part 2 of our series on GUID Partition Table structures for digital investigators.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/#breadcrumb\"},\"inLanguage\":\"nb-NO\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"nb-NO\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD2-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD2-scaled.jpg\",\"width\":2560,\"height\":1920,\"caption\":\"Hard disk drive \u2014 digital forensics evidence storage device analysis\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GPT part 2. The Role of the GPT Header in Disk Integrity.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"nb-NO\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nb-NO\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nb-NO\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/nb\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"GPT del 2. GPT-headerens rolle i diskintegritet. - Unnvikende data","description":"Explore the role of the GPT Header in maintaining disk integrity and enabling forensic analysis. Part 2 of our series on GUID Partition Table structures for digital investigators.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/nb\/2-2\/","og_locale":"nb_NO","og_type":"article","og_title":"GPT part 2. The Role of the GPT Header in Disk Integrity.","og_description":"Explore the role of the GPT Header in maintaining disk integrity and enabling forensic analysis. Part 2 of our series on GUID Partition Table structures for digital investigators.","og_url":"https:\/\/elusivedata.io\/nb\/2-2\/","og_site_name":"Elusive Data","article_published_time":"2024-11-22T16:06:10+00:00","article_modified_time":"2025-07-18T18:04:37+00:00","og_image":[{"width":2560,"height":1920,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD2-scaled.jpg","type":"image\/jpeg"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_misc":{"Skrevet av":"James Eichbaum","Ansl. lesetid":"12 minutter"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/2-2\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/2-2\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"GPT part 2. The Role of the GPT Header in Disk Integrity.","datePublished":"2024-11-22T16:06:10+00:00","dateModified":"2025-07-18T18:04:37+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/2-2\/"},"wordCount":1382,"commentCount":2,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/2-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD2-scaled.jpg","articleSection":["Digital Forensics"],"inLanguage":"nb-NO","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/2-2\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/2-2\/","url":"https:\/\/elusivedata.io\/2-2\/","name":"GPT del 2. GPT-headerens rolle i diskintegritet. - Unnvikende data","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/2-2\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/2-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD2-scaled.jpg","datePublished":"2024-11-22T16:06:10+00:00","dateModified":"2025-07-18T18:04:37+00:00","description":"Explore the role of the GPT Header in maintaining disk integrity and enabling forensic analysis. Part 2 of our series on GUID Partition Table structures for digital investigators.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/2-2\/#breadcrumb"},"inLanguage":"nb-NO","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/2-2\/"]}]},{"@type":"ImageObject","inLanguage":"nb-NO","@id":"https:\/\/elusivedata.io\/2-2\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD2-scaled.jpg","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD2-scaled.jpg","width":2560,"height":1920,"caption":"Hard disk drive \u2014 digital forensics evidence storage device analysis"},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/2-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"GPT part 2. The Role of the GPT Header in Disk Integrity."}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"ElusiveData","description":"Fremragende oppl\u00e6ring og r\u00e5dgivning innen digital etterforskning","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"nb-NO"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"ElusiveData","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"nb-NO","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"nb-NO","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/nb\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/posts\/920","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/comments?post=920"}],"version-history":[{"count":11,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/posts\/920\/revisions"}],"predecessor-version":[{"id":7452,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/posts\/920\/revisions\/7452"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/media\/579"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/media?parent=920"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/categories?post=920"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/nb\/wp-json\/wp\/v2\/tags?post=920"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}