{"id":918,"date":"2024-11-22T16:04:21","date_gmt":"2024-11-22T16:04:21","guid":{"rendered":"https:\/\/elusivedata.io\/?p=918"},"modified":"2025-07-18T18:04:38","modified_gmt":"2025-07-18T18:04:38","slug":"1-2","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/pl\/1-2\/","title":{"rendered":"Zrozumienie ochronnego MBR na dyskach z partycjami GPT. Cz\u0119\u015b\u0107 1."},"content":{"rendered":"<h1 class=\"wp-block-heading\" id=\"h-introduction\">Wprowadzenie<\/h1>\n\n\n\n<p>W tej serii wpis\u00f3w na blogu b\u0119d\u0119 zag\u0142\u0119bia\u0142 si\u0119 w schemat tabeli partycji GUID. Moim celem jest zapewnienie jasnego zrozumienia schematu GPT i tego, w jaki spos\u00f3b umo\u017cliwia on \u015bledczym dok\u0142adn\u0105 analiz\u0119 i odzyskiwanie danych z nowoczesnych urz\u0105dze\u0144 pami\u0119ci masowej. Obs\u0142uga GPT dla wi\u0119kszych dysk\u00f3w, wielu partycji i ulepszonych funkcji integralno\u015bci danych, takich jak redundancja i ochrona CRC, zapewnia \u015bledczym dost\u0119p i weryfikacj\u0119 wszystkich niezb\u0119dnych danych. Co wi\u0119cej, kompatybilno\u015b\u0107 GPT ze wsp\u00f3\u0142czesnymi systemami operacyjnymi i oprogramowaniem uk\u0142adowym UEFI zwi\u0119ksza mo\u017cliwo\u015b\u0107 przeprowadzania kompleksowych bada\u0144 kryminalistycznych, czyni\u0105c go niezb\u0119dnym do odkrywania dowod\u00f3w cyfrowych i zapewnienia integralno\u015bci i wiarygodno\u015bci ustale\u0144 kryminalistycznych.&nbsp;<\/p>\n\n\n\n<p>Zaczn\u0119 od Protective MBR i tego, czym r\u00f3\u017cni si\u0119 on od tradycyjnego MBR u\u017cywanego ze starszymi dyskami w BIOS-ie. Nast\u0119pnie om\u00f3wi\u0119 nag\u0142\u00f3wek GPT, a nast\u0119pnie tablic\u0119 wpis\u00f3w GPT. Na koniec podziel\u0119 si\u0119 kilkoma ko\u0144cowymi przemy\u015bleniami i wskaz\u00f3wkami dotycz\u0105cymi wyja\u015bniania tych poj\u0119\u0107 laikom, na przyk\u0142ad podczas zeznawania przed s\u0119dzi\u0105 lub \u0142aw\u0105 przysi\u0119g\u0142ych.<\/p>\n\n\n\n<p>Ostatecznie, po przeczytaniu tej serii, nie b\u0119dziesz mia\u0142 problemu z podj\u0119ciem wyzwania CTF na naszej platformie CTF.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"h-part-1\">CZ\u0118\u015a\u0106 1<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-the-protective-mbr\">Ochronny MBR<\/h2>\n\n\n\n<p>G\u0142\u00f3wny rekord rozruchowy (MBR) ze starszego punktu widzenia zapewnia\u0142 nam map\u0119 drogow\u0105 do zlokalizowania do czterech partycji podstawowych na dysku twardym. Ka\u017cdy 16-bajtowy wpis partycji prowadzi\u0142 nas do lokalizacji tej partycji, niezale\u017cnie od tego, czy by\u0142a to partycja FAT32, czy NTFS. Jednak stary MBR mia\u0142 ograniczenia, w tym mi\u0119dzy innymi:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Limit rozmiaru wynosz\u0105cy 2 TB.<\/li>\n\n\n\n<li>Ograniczenie do 4 partycji podstawowych; je\u015bli potrzeba ich wi\u0119cej, jedna z nich zostanie wyznaczona jako partycja rozszerzona.<\/li>\n\n\n\n<li>Pojedynczy punkt awarii, poniewa\u017c MBR, kt\u00f3ry zawiera tablic\u0119 partycji, znajdowa\u0142 si\u0119 w sektorze 0 bez kopii zapasowej.<\/li>\n<\/ul>\n\n\n\n<p>LBA 0 (sektor logiczny 0) dysku twardego GPT zawiera tak zwany ochronny MBR, a nie starszy MBR. Pomy\u015bl o Protective MBR jak o znaku przy wej\u015bciu do biblioteki, kt\u00f3ry m\u00f3wi wszystkim: \"Hej, ta biblioteka u\u017cywa teraz nowego i ulepszonego systemu. Nie u\u017cywaj starej metody, poniewa\u017c tutaj nie zadzia\u0142a\".<\/p>\n\n\n\n<p>Zamiast zawiera\u0107 lokalizacj\u0119 tylko czterech partycji podstawowych na dysku, Protective MBR oznacza ca\u0142y dysk jako u\u017cywany przez GPT, wskazuj\u0105c starszym systemom, \u017ce dysk jest w pe\u0142ni wykorzystywany. Protective MBR istnieje tylko dla kompatybilno\u015bci wstecznej. Zawiera TYLKO jeden wpis partycji, kt\u00f3ry oznacza dysk i zapobiega b\u0142\u0119dnej interpretacji struktury dysku przez starsze narz\u0119dzia.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-structure-of-the-protective-mbr\">Struktura ochronnego reaktora MBR<\/h3>\n\n\n\n<p>Pierwsze 440 bajt\u00f3w ochronnego MBR zawiera kod rozruchowy, kt\u00f3ry nie jest u\u017cywany przez systemy UEFI. Jest on ignorowany.&nbsp;&nbsp;<\/p>\n\n\n\n<p>Poni\u017cej znajduje si\u0119 hipotetyczny uk\u0142ad dysku ze \u015bwie\u017c\u0105 instalacj\u0105 systemu Windows 10 z tylko jedn\u0105 partycj\u0105 utworzon\u0105 podczas procesu instalacji, dysk C:. Partycja systemowa UEFI jest tworzona automatycznie i ukryta przed u\u017cytkownikiem, a partycja Microsoft Reserved jest r\u00f3wnie\u017c tworzona podczas instalacji i ukryta przed u\u017cytkownikiem.&nbsp;<\/p>\n\n\n\n<p>Tutaj mo\u017cemy zobaczy\u0107 MBR Protective rezyduj\u0105cy w LBA 0, kt\u00f3ry wskazuje na nag\u0142\u00f3wek GPT w LBA 1.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img fetchpriority=\"high\" decoding=\"async\" width=\"740\" height=\"164\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1.png\" alt=\"\" class=\"wp-image-924\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1.png 740w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1-600x133.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1-300x66.png 300w\" sizes=\"(max-width: 740px) 100vw, 740px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-hex-layout-of-the-protective-mbr\">Uk\u0142ad szesnastkowy ochronnego MBR<\/h3>\n\n\n\n<p>Oto przyk\u0142adowy uk\u0142ad szesnastkowy ochronnego MBR:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"751\" height=\"650\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1.png\" alt=\"\" class=\"wp-image-925\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1.png 751w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1-600x519.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1-300x260.png 300w\" sizes=\"(max-width: 751px) 100vw, 751px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"749\" height=\"159\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1.png\" alt=\"\" class=\"wp-image-926\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1.png 749w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1-600x127.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1-300x64.png 300w\" sizes=\"(max-width: 749px) 100vw, 749px\" \/><\/figure>\n\n\n\n<p>Jak wspomniano wcze\u015bniej, pierwsze 440 bajt\u00f3w kodu rozruchowego nie jest u\u017cywane przez systemy UEFI. W niekt\u00f3rych systemach te pierwsze 440 bajt\u00f3w mo\u017ce by\u0107 wyzerowane. Oto ochronny MBR ze stacji roboczej, kt\u00f3rej u\u017cywam do pisania tego bloga, gdzie u\u017cywam dysku Samsung 1TB NVME:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"811\" height=\"814\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2.png\" alt=\"\" class=\"wp-image-928\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2.png 811w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-300x300.png 300w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-100x100.png 100w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-600x602.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-150x150.png 150w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-768x771.png 768w\" sizes=\"(max-width: 811px) 100vw, 811px\" \/><\/figure>\n\n\n\n<p>Jak wida\u0107, ca\u0142y Protective MBR w tym przypadku zawiera zera z wyj\u0105tkiem czterech bajt\u00f3w znajduj\u0105cych si\u0119 na offsecie 440 (kt\u00f3re nie s\u0105 u\u017cywane), pierwszego \"wpisu partycji podstawowej\" (kt\u00f3ry wskazuje tylko na LBA 1 - nag\u0142\u00f3wek GPT) oraz sygnatury rozruchowej znajduj\u0105cej si\u0119 na dw\u00f3ch ostatnich bajtach sektora (0x55AA).&nbsp;<\/p>\n\n\n\n<p>Przyjrzyjmy si\u0119 teraz bli\u017cej jednemu wpisowi partycji, kt\u00f3ry istnieje w Protective MBR:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"748\" height=\"647\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3.png\" alt=\"\" class=\"wp-image-929\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3.png 748w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3-600x519.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3-300x259.png 300w\" sizes=\"(max-width: 748px) 100vw, 748px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"752\" height=\"138\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2.png\" alt=\"\" class=\"wp-image-930\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2.png 752w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2-600x110.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2-300x55.png 300w\" sizes=\"(max-width: 752px) 100vw, 752px\" \/><\/figure>\n\n\n\n<p>Pierwszy bajt wpisu partycji jest ustawiony na 0x00, aby wskaza\u0107, \u017ce nie jest to partycja rozruchowa. W tradycyjnym MBR warto\u015b\u0107 ta wynosi\u0142aby 0x00 (nie bootowalna) lub 0x80 (bootowalna). Nast\u0119pne trzy bajty reprezentuj\u0105 <strong>Rozpocz\u0119cie CHS <\/strong>(Cylinder\/G\u0142owa\/Sektor), kt\u00f3ra b\u0119dzie odpowiada\u0107 4-bajtowej warto\u015bci w polu <strong>Rozpocz\u0119cie LBA<\/strong> przy przesuni\u0119ciu bajtu 8. Warto\u015b\u0107 pocz\u0105tkowa CHS zostanie ustawiona na <strong>0x000200<\/strong> kt\u00f3ry po rozbiciu i przekonwertowaniu na adres LBA wynosi 1.<\/p>\n\n\n\n<p>Nast\u0119puj\u0105ca warto\u015b\u0107 jednobajtowa jest ustawiona na <strong>0xEE<\/strong> dla typu systemu operacyjnego: <strong>GPT Protective<\/strong>. Trzybajtowa warto\u015b\u0107 na offsecie 5 jest ustawiona na adres CHS ostatniego bloku logicznego na dysku. Pocz\u0105tkowy LBA, prowadz\u0105cy nas do nag\u0142\u00f3wka partycji GPT, znajduje si\u0119 na offsecie 8 dla czterech bajt\u00f3w, a jego warto\u015b\u0107 zostanie ustawiona na <strong>0x01000000<\/strong> (lub LBA 1 przy odczycie little endian). Ostatnie 4 bajty rekordu w przesuni\u0119ciu 12 reprezentuj\u0105 rozmiar dysku minus jeden. Jest on ustawiony na <strong>0xFFFFFFFF<\/strong> je\u015bli rozmiar dysku jest zbyt du\u017cy, aby m\u00f3g\u0142 by\u0107 reprezentowany w tym polu, co najprawdopodobniej ma miejsce.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-repairing-a-protective-mrb\">Naprawa ochronnego MRB<\/h3>\n\n\n\n<p>Je\u015bli MBR zosta\u0142 uszkodzony, utracony lub wyczyszczony, mo\u017cna zast\u0105pi\u0107 sektor 0, kopiuj\u0105c ochronny MBR z innego dysku. Mo\u017cna r\u00f3wnie\u017c utworzy\u0107 go od podstaw, pozostawiaj\u0105c 0x00 od offsetu 0 do 446, a nast\u0119pnie tworz\u0105c og\u00f3lny wpis partycji wskazuj\u0105cy na LBA 1, upewniaj\u0105c si\u0119, \u017ce 0xEE istnieje na offsecie 4, aby wskaza\u0107 typ GPT Protective OS. Na koniec nale\u017cy umie\u015bci\u0107 sygnatur\u0119 rozruchow\u0105 (0x55AA) na ostatnich dw\u00f3ch bajtach sektora.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-generic-entry\"><em>Wpis og\u00f3lny<\/em><\/h4>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>446<\/td><td>447<\/td><td>448<\/td><td>449<\/td><td>450<\/td><td>451<\/td><td>452<\/td><td>453<\/td><td>454<\/td><td>455<\/td><td>456<\/td><td>457<\/td><td>458<\/td><td>459<\/td><td>460<\/td><td>461<\/td><\/tr><tr><td>00<\/td><td>00<\/td><td>02<\/td><td>00<\/td><td>EE<\/td><td>FF<\/td><td>FF<\/td><td>FF<\/td><td>01<\/td><td>00<\/td><td>00<\/td><td>00<\/td><td>FF<\/td><td>FF<\/td><td>FF<\/td><td>FF<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-boot-signature\"><em>Podpis buta<\/em><\/h4>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>510<\/td><td>511<\/td><\/tr><tr><td>55<\/td><td>AA<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>W przypadku odbudowanego MBR Protective wystarcz\u0105 nast\u0119puj\u0105ce czynno\u015bci:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"508\" height=\"449\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD4.png\" alt=\"\" class=\"wp-image-932\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD4.png 508w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD4-300x265.png 300w\" sizes=\"(max-width: 508px) 100vw, 508px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-conclusion\">Wnioski<\/h2>\n\n\n\n<p>W tej pierwszej cz\u0119\u015bci zbadali\u015bmy ochronny MBR i jego kluczow\u0105 rol\u0119 w zapewnianiu wstecznej kompatybilno\u015bci ze starszymi systemami. Zbadali\u015bmy, w jaki spos\u00f3b Protective MBR oznacza ca\u0142y dysk jako u\u017cywany przez GPT, zapobiegaj\u0105c b\u0142\u0119dnej interpretacji struktury dysku przez starsze systemy. Dzi\u0119ki zrozumieniu struktury i funkcji Protective MBR, masz teraz solidne podstawy do zag\u0142\u0119bienia si\u0119 w schemat GPT.<\/p>\n\n\n\n<p>Id\u0105c dalej, skupimy si\u0119 na nag\u0142\u00f3wku GPT, kamieniu w\u0119gielnym schematu GPT, kt\u00f3ry definiuje uk\u0142ad dysku i zapewnia integralno\u015b\u0107 danych. W cz\u0119\u015bci 2 om\u00f3wimy nag\u0142\u00f3wek GPT, analizuj\u0105c ka\u017cde pole i jego znaczenie. B\u0105d\u017a na bie\u017c\u0105co, poniewa\u017c nadal odkrywamy zawi\u0142o\u015bci schematu GPT, daj\u0105c ci wiedz\u0119, kt\u00f3ra pozwoli ci skutecznie zarz\u0105dza\u0107 i odzyskiwa\u0107 dane z nowoczesnych urz\u0105dze\u0144 pami\u0119ci masowej.<\/p>\n\n\n\n<p><strong>Chcesz zag\u0142\u0119bi\u0107 si\u0119 w struktur\u0119 GPT?<br><\/strong><br>W <a class=\"\" href=\"https:\/\/elusivedata.io\/pl\/2-2\/\"><strong>Cz\u0119\u015b\u0107 2<\/strong><\/a>rozk\u0142adamy <strong>Nag\u0142\u00f3wek GPT<\/strong> i wyja\u015bni\u0107, w jaki spos\u00f3b zapewnia integralno\u015b\u0107 danych na dysku.<br>Nast\u0119pnie w <a class=\"\" href=\"https:\/\/elusivedata.io\/pl\/3-2\/\"><strong>Cz\u0119\u015b\u0107 3<\/strong><\/a>badamy <strong>Tablica wpis\u00f3w partycji GPT<\/strong> i co analitycy kryminalistyczni powinni wiedzie\u0107 podczas rekonstrukcji tabel partycji.<\/p>","protected":false},"excerpt":{"rendered":"<p>Poznaj rol\u0119 ochronnego MBR na dyskach z partycjami GPT. Ten przewodnik zag\u0142\u0119bia si\u0119 w jego cel, funkcjonalno\u015b\u0107 i znaczenie w cyfrowych dochodzeniach kryminalistycznych.<\/p>","protected":false},"author":1,"featured_media":748,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"blog-post","footnotes":""},"categories":[19],"tags":[],"class_list":["post-918","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digital-forensics"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.3 (Yoast SEO v27.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Understanding the Protective MBR in GPT-Partitioned Disks. Part 1. - Elusive Data<\/title>\n<meta name=\"description\" content=\"Learn how the Protective MBR works in GPT-partitioned disks and why it matters in digital forensic investigations. Part 1 of our deep-dive series.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/pl\/1-2\/\" \/>\n<meta property=\"og:locale\" content=\"pl_PL\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Understanding the Protective MBR in GPT-Partitioned Disks.\" \/>\n<meta property=\"og:description\" content=\"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/pl\/1-2\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-22T16:04:21+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46-1024x675.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Understanding the Protective MBR in GPT-Partitioned Disks.\" \/>\n<meta name=\"twitter:description\" content=\"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png\" \/>\n<meta name=\"twitter:label1\" content=\"Napisane przez\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Szacowany czas czytania\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minut\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1.\",\"datePublished\":\"2024-11-22T16:04:21+00:00\",\"dateModified\":\"2025-07-18T18:04:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\"},\"wordCount\":1133,\"commentCount\":5,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"articleSection\":[\"Digital Forensics\"],\"inLanguage\":\"pl-PL\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\",\"name\":\"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1. - Elusive Data\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"datePublished\":\"2024-11-22T16:04:21+00:00\",\"dateModified\":\"2025-07-18T18:04:38+00:00\",\"description\":\"Learn how the Protective MBR works in GPT-partitioned disks and why it matters in digital forensic investigations. Part 1 of our deep-dive series.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#breadcrumb\"},\"inLanguage\":\"pl-PL\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pl-PL\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"width\":2662,\"height\":1754,\"caption\":\"Close-up of a hard disk drive, used to illustrate GPT disk structure in digital forensics.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pl-PL\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pl-PL\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pl-PL\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/pl\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Zrozumienie ochronnego MBR na dyskach z partycjami GPT. Cz\u0119\u015b\u0107 1. - Nieuchwytne dane","description":"Dowiedz si\u0119, jak dzia\u0142a Protective MBR na dyskach z partycjami GPT i dlaczego ma to znaczenie w cyfrowych dochodzeniach kryminalistycznych. Cz\u0119\u015b\u0107 1 naszej dog\u0142\u0119bnej serii.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/pl\/1-2\/","og_locale":"pl_PL","og_type":"article","og_title":"Understanding the Protective MBR in GPT-Partitioned Disks.","og_description":"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.","og_url":"https:\/\/elusivedata.io\/pl\/1-2\/","og_site_name":"Elusive Data","article_published_time":"2024-11-22T16:04:21+00:00","article_modified_time":"2025-07-18T18:04:38+00:00","og_image":[{"width":1024,"height":675,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46-1024x675.png","type":"image\/png"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_title":"Understanding the Protective MBR in GPT-Partitioned Disks.","twitter_description":"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.","twitter_image":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","twitter_misc":{"Napisane przez":"James Eichbaum","Szacowany czas czytania":"7 minut"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/1-2\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/1-2\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1.","datePublished":"2024-11-22T16:04:21+00:00","dateModified":"2025-07-18T18:04:38+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/1-2\/"},"wordCount":1133,"commentCount":5,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","articleSection":["Digital Forensics"],"inLanguage":"pl-PL","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/1-2\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/1-2\/","url":"https:\/\/elusivedata.io\/1-2\/","name":"Zrozumienie ochronnego MBR na dyskach z partycjami GPT. Cz\u0119\u015b\u0107 1. - Nieuchwytne dane","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","datePublished":"2024-11-22T16:04:21+00:00","dateModified":"2025-07-18T18:04:38+00:00","description":"Dowiedz si\u0119, jak dzia\u0142a Protective MBR na dyskach z partycjami GPT i dlaczego ma to znaczenie w cyfrowych dochodzeniach kryminalistycznych. Cz\u0119\u015b\u0107 1 naszej dog\u0142\u0119bnej serii.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/1-2\/#breadcrumb"},"inLanguage":"pl-PL","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/1-2\/"]}]},{"@type":"ImageObject","inLanguage":"pl-PL","@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","width":2662,"height":1754,"caption":"Close-up of a hard disk drive, used to illustrate GPT disk structure in digital forensics."},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/1-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1."}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"ElusiveData","description":"Doskona\u0142o\u015b\u0107 w zakresie szkole\u0144 i doradztwa w dziedzinie informatyki \u015bledczej","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pl-PL"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"ElusiveData","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"pl-PL","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"pl-PL","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/pl\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/posts\/918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/comments?post=918"}],"version-history":[{"count":7,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/posts\/918\/revisions"}],"predecessor-version":[{"id":7450,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/posts\/918\/revisions\/7450"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/media\/748"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/media?parent=918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/categories?post=918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/tags?post=918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}