{"id":922,"date":"2024-11-22T16:07:40","date_gmt":"2024-11-22T16:07:40","guid":{"rendered":"https:\/\/elusivedata.io\/?p=922"},"modified":"2025-07-18T18:04:35","modified_gmt":"2025-07-18T18:04:35","slug":"3-2","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/nl\/3-2\/","title":{"rendered":"Navigeren door de GPT Partition Entry Array voor forensische analyse. Deel 3."},"content":{"rendered":"<div data-elementor-type=\"wp-post\" data-elementor-id=\"922\" class=\"elementor elementor-922\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3c34a31 e-flex e-con-boxed e-con e-parent\" data-id=\"3c34a31\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-651d9f61 elementor-widget elementor-widget-text-editor\" data-id=\"651d9f61\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><\/p>\n<h1 class=\"wp-block-heading\">Deel 3<\/h1>\n<p><\/p>\n<h2 class=\"wp-block-heading\">Inleiding<\/h2>\n<p><\/p>\n<p>In onze vorige posts hebben we de basis gelegd voor het begrijpen van de GUID Partition Table (GPT) door de Protective MBR en de GPT Header te onderzoeken. Nu, in deel 3, richten we onze aandacht op de GPT Partition Entry Array. Dit cruciale onderdeel van het GPT-schema biedt een gedetailleerde kaart van alle partities op de schijf, waarbij elk item vitale informatie bevat over een specifieke partitie. Door de structuur en functie van de GPT Partition Entry Array te begrijpen, krijg je een uitgebreid beeld van hoe GPT partities beheert, waardoor je effectievere analyses, probleemoplossing en gegevensherstel kunt uitvoeren.<\/p>\n<p><\/p>\n<h2 class=\"wp-block-heading\">GPT (GUID-partitietabel) Partitie Entry Array<\/h2>\n<p><\/p>\n<p>De GUID Partition Table (GPT) Entry Array is een kritisch onderdeel van het GPT partitioneringssysteem, dat wordt gebruikt om de partities op een harde schijf te defini\u00ebren en beheren. Zie het als een gedetailleerde lijst die de details van elke partitie op de schijf vastlegt, zoals de catalogus van een bibliotheek die de details van elk boek vastlegt.<\/p>\n<p><\/p>\n<h3 class=\"wp-block-heading\">Belangrijkste onderdelen van de GPT Entry Array:<\/h3>\n<p><\/p>\n<p><strong>Partitie GUID<\/strong>: Elke partitie heeft een unieke identifier, bekend als de Partition GUID, die ervoor zorgt dat elke partitie uniek ge\u00efdentificeerd kan worden, zelfs op verschillende systemen.<\/p>\n<p><\/p>\n<p><strong>Uniek ID<\/strong>: Dit is nog een unieke identificatie die specifiek is voor elke partitie en die een extra laag van unieke identificatie biedt.<\/p>\n<p><\/p>\n<p><strong>LBA (Logical Block Addressing) van de partitie starten<\/strong>: Dit geeft het beginpunt van de partitie op de schijf aan. Het vertelt het systeem waar de partitie begint.<\/p>\n<p><\/p>\n<p><strong>Einde LBA van partitie<\/strong>: Net als de start-LBA geeft dit aan waar de partitie eindigt op de schijf.<\/p>\n<p><\/p>\n<p><strong>Attribuut Bits<\/strong>: Dit zijn vlaggen die extra informatie geven over de partitie, zoals of deze bootable is of speciale attributen heeft.<\/p>\n<p><\/p>\n<p><strong>Naam van partitie<\/strong>: Elke partitie kan een menselijk leesbare naam hebben, zodat we gemakkelijker het doel of de inhoud van de partitie kunnen identificeren. Deze naam wordt afgesloten met een null karakter om het einde van de string aan te geven.<\/p>\n<p><\/p>\n<p>Laten we deze allemaal in detail uitwerken, zodat je elk item in de array volledig begrijpt.<\/p>\n<p><\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog3-HxD1.png\" alt=\"\" \/><\/figure>\n<p><\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog3-Table1.png\" alt=\"\" \/><\/figure>\n<p><\/p>\n<p>Wanneer de schijf is ingesteld als een GPT-schijf, is de eerste partitie die wordt aangemaakt de EFI System Partition (ESP). Dit is een verborgen partitie die niet direct beschikbaar is voor gebruikers. Deze partitie bevindt zich op sector 2048 en is geformatteerd als FAT32 voor compatibiliteit met alle systemen (Windows, Linux, MacOS).<\/p>\n<p><\/p>\n<p>De bovenstaande schermafbeelding toont een standaard Windows 10-installatie waarbij de Microsoft Reserved Partition is aangemaakt samen met \u00e9\u00e9n Basic Data Partition die door de gebruiker is opgegeven tijdens de installatie.<\/p>\n<p><\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog3-Image_Series1.png\" alt=\"\" \/><\/figure>\n<p><\/p>\n<p>Hieronder staat een uittreksel van GUID's uit een tabel die te vinden is op de GUID Partition Table Wikipedia pagina:<\/p>\n<p><\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog3-Wiki-Page.png\" alt=\"\" \/><\/figure>\n<p><\/p>\n<p>Bron: <a href=\"https:\/\/en.wikipedia.org\/wiki\/GUID_Partition_Table#Partition_type_GUIDs\">https:\/\/en.wikipedia.org\/wiki\/GUID_Partition_Table#Partition_type_GUIDs<\/a><\/p>\n<p><\/p>\n<p>Natuurlijk wordt de GUID niet opgeslagen in de GUIID vorm als je de waarden bekijkt in de hex viewer.\u00a0<\/p>\n<p><\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog3-Image_Series2.png\" alt=\"\" \/><\/figure>\n<p><\/p>\n<p>De GUID's worden geconverteerd zoals we in de vorige blogpost hebben gedaan, maar zijn ook goed te zien als je het in HxD bekijkt:<\/p>\n<p><\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog3-HxD2.png\" alt=\"\" \/><\/figure>\n<p><\/p>\n<p>We kunnen de GUID's van de volumepartitie bevestigen met de opdracht: mountvol.exe<\/p>\n<p><\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog3-CommandWindow.png\" alt=\"\" \/><\/figure>\n<p><\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog3-Image_Series3-right-background.png\" alt=\"\" \/><\/figure>\n<p><\/p>\n<p>Als we de start-LBA en eind-LBA weten, kunnen we berekenen hoe groot de partitie is. Bijvoorbeeld de EFI-partitie:<\/p>\n<p><\/p>\n<p>Beginnende LBA: 2048<\/p>\n<p><\/p>\n<p>Einde LBA: 534527<\/p>\n<p><\/p>\n<p>Totale lengte: 532479 sectoren x 512 bytes\/sector = 272629248 bytes wat 260 MB is.<\/p>\n<p><\/p>\n<figure><img decoding=\"async\" style=\"width: 645px; height: auto;\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog3-Disk0-Shot.png\" alt=\"\" \/><\/figure>\n<p><\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog3-Image_Series4-right-background.png\" alt=\"\" \/><\/figure>\n<p><\/p>\n<h2 class=\"wp-block-heading\">De back-up GPT partitie Entry Array<\/h2>\n<p><\/p>\n<p>De Backup GPT Partition Entry Array bevindt zich aan het einde van de schijf en voor de GPT Header, namelijk 33 sectoren voor het einde van de schijf (LBA (n - 33) waarbij n de laatste sector van de schijf is). We kunnen ook berekenen waarom het 33 sectoren voor het einde van de schijf is, of 32 sectoren voor de Backup GPT Header.<\/p>\n<p><\/p>\n<p>Elke partitie entry is 128 bytes en er zijn in totaal 128 entries in de Entry Array. Dat betekent dat er 16.384 sectoren in de Array zijn of 32 sectoren (16384\/512).\u00a0<\/p>\n<p><\/p>\n<p>De Backup GPT Header wijst naar de locatie van de Backup GPT Partition Entry Array.<\/p>\n<p><\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog3-Figure1.png\" alt=\"\" \/><\/figure>\n<p><\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog3-HxD3.png\" alt=\"\" \/><\/figure>\n<p><\/p>\n<p>Back-up GPT Partitie Invoer Array Bijna Einde Schijf<\/p>\n<p><\/p>\n<h2 class=\"wp-block-heading\">Een GPT Partition Entry Array repareren<\/h2>\n<p><\/p>\n<p>Het repareren van de GPT Partition Entry Array is zo eenvoudig als het kopi\u00ebren van de 16.384-byte back-up gevonden 33 sectoren vanaf het einde van de schijf en deze in LBA 2 tot en met 3 te plakken. Er zijn geen wijzigingen\/wijzigingen van hex-waarden nodig omdat dit exacte kopie\u00ebn zijn.<\/p>\n<p><\/p>\n<p>De backup GPT aan het einde van de schijf is hetzelfde als de primaire. In feite laat het uitsnijden van de sectoren voor beide en het hashen ervan zien dat ze exact overeenkomen.\u00a0<\/p>\n<p><\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog3-HxD4-Final-Shot-before-Conclusion.png\" alt=\"\" \/><\/figure>\n<p><\/p>\n<h2 class=\"wp-block-heading\">Conclusie<\/h2>\n<p><\/p>\n<p>In deze derde aflevering hebben we de GPT Partition Entry Array, een kritisch onderdeel van het GPT schema, grondig onderzocht. Door het opsplitsen van elk veld binnen de partitie entries, van de GUID's tot de attribuut bits en partitie namen, hebben we gezien hoe GPT een robuust raamwerk biedt voor het organiseren en benaderen van schijfgegevens. Deze kennis is essentieel voor forensisch onderzoek, gegevensherstel en systeembeheer, en geeft je de vaardigheden om effectief te navigeren en GPT-gepartitioneerde schijven te manipuleren. Blijf kijken voor ons volgende bericht, waarin we dieper ingaan op praktische toepassingen en casestudy's en de theorie in praktijk brengen.<\/p>\n<p data-start=\"324\" data-end=\"697\"><strong data-start=\"327\" data-end=\"397\">Deze post sluit onze 3-delige serie over GPT-partitiestructuren af.<\/strong><br data-start=\"397\" data-end=\"400\" \/>Als je de eerdere berichten hebt gemist, begin dan met <a class=\"\" href=\"https:\/\/elusivedata.io\/nl\/1-2\/\" target=\"_new\" rel=\"noopener\" data-start=\"446\" data-end=\"508\"><strong data-start=\"447\" data-end=\"478\">Deel 1 - De beschermende MBR<\/strong><\/a>, waarin we onderzoeken hoe legacy-compatibiliteit wordt onderhouden, en gaan verder met <a class=\"\" href=\"https:\/\/elusivedata.io\/nl\/2-2\/\" target=\"_new\" rel=\"noopener\" data-start=\"585\" data-end=\"643\"><strong data-start=\"586\" data-end=\"613\">Deel 2 - De GPT-header<\/strong><\/a>die de schijfindeling definieert en de integriteit garandeert.<\/p>\n<p data-start=\"702\" data-end=\"856\">Wil je dieper gaan? Abonneer je op onze nieuwsbrief voor toekomstige inhoud over partitieherstel, hashing op schijfniveau en CTF-uitdagingen gebaseerd op echte forensische scenario's.<\/p>\n<p><\/p>\n<p><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>Krijg meer inzicht in de GPT Partition Entry Array en het belang ervan in digitale forensische analyse. Deze gids verkent de belangrijkste technieken en inzichten om uw forensisch onderzoek te verbeteren.<\/p>","protected":false},"author":1,"featured_media":580,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[19],"tags":[],"class_list":["post-922","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digital-forensics"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.3 (Yoast SEO v27.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3. - Elusive Data<\/title>\n<meta name=\"description\" content=\"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/nl\/3-2\/\" \/>\n<meta property=\"og:locale\" content=\"nl_NL\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.\" \/>\n<meta property=\"og:description\" content=\"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/nl\/3-2\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-22T16:07:40+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:35+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1707\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Geschreven door\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Geschatte leestijd\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minuten\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.\",\"datePublished\":\"2024-11-22T16:07:40+00:00\",\"dateModified\":\"2025-07-18T18:04:35+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\"},\"wordCount\":919,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD3-1-scaled.jpg\",\"articleSection\":[\"Digital Forensics\"],\"inLanguage\":\"nl-NL\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\",\"name\":\"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3. - Elusive Data\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD3-1-scaled.jpg\",\"datePublished\":\"2024-11-22T16:07:40+00:00\",\"dateModified\":\"2025-07-18T18:04:35+00:00\",\"description\":\"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#breadcrumb\"},\"inLanguage\":\"nl-NL\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"nl-NL\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD3-1-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD3-1-scaled.jpg\",\"width\":2560,\"height\":1707,\"caption\":\"Hard disk drive \u2014 digital forensics evidence storage device analysis\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"nl-NL\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nl-NL\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nl-NL\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/nl\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Navigeren door de GPT Partition Entry Array voor forensische analyse. Deel 3. - Ongrijpbare gegevens","description":"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/nl\/3-2\/","og_locale":"nl_NL","og_type":"article","og_title":"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.","og_description":"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.","og_url":"https:\/\/elusivedata.io\/nl\/3-2\/","og_site_name":"Elusive Data","article_published_time":"2024-11-22T16:07:40+00:00","article_modified_time":"2025-07-18T18:04:35+00:00","og_image":[{"width":2560,"height":1707,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","type":"image\/jpeg"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_misc":{"Geschreven door":"James Eichbaum","Geschatte leestijd":"7 minuten"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/3-2\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/3-2\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.","datePublished":"2024-11-22T16:07:40+00:00","dateModified":"2025-07-18T18:04:35+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/3-2\/"},"wordCount":919,"commentCount":1,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/3-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","articleSection":["Digital Forensics"],"inLanguage":"nl-NL","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/3-2\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/3-2\/","url":"https:\/\/elusivedata.io\/3-2\/","name":"Navigeren door de GPT Partition Entry Array voor forensische analyse. Deel 3. - Ongrijpbare gegevens","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/3-2\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/3-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","datePublished":"2024-11-22T16:07:40+00:00","dateModified":"2025-07-18T18:04:35+00:00","description":"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/3-2\/#breadcrumb"},"inLanguage":"nl-NL","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/3-2\/"]}]},{"@type":"ImageObject","inLanguage":"nl-NL","@id":"https:\/\/elusivedata.io\/3-2\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","width":2560,"height":1707,"caption":"Hard disk drive \u2014 digital forensics evidence storage device analysis"},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/3-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3."}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"ElusiveData","description":"Uitmuntendheid in digitale forensische training en advies","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"nl-NL"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"ElusiveData","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"nl-NL","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"nl-NL","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/nl\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/nl\/wp-json\/wp\/v2\/posts\/922","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/nl\/wp-json\/wp\/v2\/comments?post=922"}],"version-history":[{"count":9,"href":"https:\/\/elusivedata.io\/nl\/wp-json\/wp\/v2\/posts\/922\/revisions"}],"predecessor-version":[{"id":7455,"href":"https:\/\/elusivedata.io\/nl\/wp-json\/wp\/v2\/posts\/922\/revisions\/7455"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/nl\/wp-json\/wp\/v2\/media\/580"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/nl\/wp-json\/wp\/v2\/media?parent=922"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/nl\/wp-json\/wp\/v2\/categories?post=922"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/nl\/wp-json\/wp\/v2\/tags?post=922"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}