{"id":922,"date":"2024-11-22T16:07:40","date_gmt":"2024-11-22T16:07:40","guid":{"rendered":"https:\/\/elusivedata.io\/?p=922"},"modified":"2025-07-18T18:04:35","modified_gmt":"2025-07-18T18:04:35","slug":"3-2","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/pl\/3-2\/","title":{"rendered":"Poruszanie si\u0119 po tablicy wpis\u00f3w partycji GPT na potrzeby analizy kryminalistycznej. Cz\u0119\u015b\u0107 3."},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>\n

Cz\u0119\u015b\u0107 3<\/h1>\n

<\/p>\n

Wprowadzenie<\/h2>\n

<\/p>\n

W naszych poprzednich postach po\u0142o\u017cyli\u015bmy podwaliny pod zrozumienie tablicy partycji GUID (GPT), analizuj\u0105c ochronny MBR i nag\u0142\u00f3wek GPT. Teraz, w cz\u0119\u015bci 3, skupiamy si\u0119 na tablicy wpis\u00f3w partycji GPT. Ten kluczowy sk\u0142adnik schematu GPT zapewnia szczeg\u00f3\u0142ow\u0105 map\u0119 wszystkich partycji na dysku, a ka\u017cdy wpis zawiera istotne informacje o okre\u015blonej partycji. Dzi\u0119ki zrozumieniu struktury i funkcji tablicy wpis\u00f3w partycji GPT uzyskasz kompleksowy obraz tego, jak GPT zarz\u0105dza partycjami, umo\u017cliwiaj\u0105c bardziej efektywn\u0105 analiz\u0119, rozwi\u0105zywanie problem\u00f3w i odzyskiwanie danych.<\/p>\n

<\/p>\n

Tablica wpis\u00f3w partycji GPT (GUID Partition Table)<\/h2>\n

<\/p>\n

Tablica wpis\u00f3w tablicy partycji GUID (GPT) jest krytyczn\u0105 cz\u0119\u015bci\u0105 systemu partycjonowania GPT, kt\u00f3ry s\u0142u\u017cy do definiowania i zarz\u0105dzania partycjami na dysku twardym. Jest to szczeg\u00f3\u0142owa lista, kt\u00f3ra rejestruje specyfik\u0119 ka\u017cdej partycji na dysku, podobnie jak katalog biblioteki, kt\u00f3ry zawiera szczeg\u00f3\u0142owe informacje o ka\u017cdej ksi\u0105\u017cce.<\/p>\n

<\/p>\n

Kluczowe sk\u0142adniki tablicy wpis\u00f3w GPT:<\/h3>\n

<\/p>\n

Identyfikator GUID partycji<\/strong>: Ka\u017cda partycja ma unikalny identyfikator, znany jako Partition GUID, kt\u00f3ry zapewnia, \u017ce ka\u017cda partycja mo\u017ce by\u0107 jednoznacznie zidentyfikowana, nawet w r\u00f3\u017cnych systemach.<\/p>\n

<\/p>\n

Unikalny identyfikator<\/strong>: Jest to kolejny unikalny identyfikator specyficzny dla ka\u017cdej partycji, zapewniaj\u0105cy dodatkow\u0105 warstw\u0119 unikalnej identyfikacji.<\/p>\n

<\/p>\n

Rozpocz\u0119cie adresowania LBA (Logical Block Addressing) partycji<\/strong>: Wskazuje punkt pocz\u0105tkowy partycji na dysku. Informuje system, gdzie zaczyna si\u0119 partycja.<\/p>\n

<\/p>\n

Ko\u0144cowa LBA partycji<\/strong>: Podobnie jak pocz\u0105tkowe LBA, wskazuje miejsce zako\u0144czenia partycji na dysku.<\/p>\n

<\/p>\n

Bity atrybut\u00f3w<\/strong>: S\u0105 to flagi, kt\u00f3re dostarczaj\u0105 dodatkowych informacji o partycji, takich jak to, czy jest ona bootowalna lub czy ma jakie\u015b specjalne atrybuty.<\/p>\n

<\/p>\n

Nazwa partycji<\/strong>: Ka\u017cda partycja mo\u017ce mie\u0107 czyteln\u0105 dla cz\u0142owieka nazw\u0119, co u\u0142atwia nam identyfikacj\u0119 celu lub zawarto\u015bci partycji. Ta nazwa jest zako\u0144czona znakiem null, aby oznaczy\u0107 koniec ci\u0105gu.<\/p>\n

<\/p>\n

Om\u00f3wmy je szczeg\u00f3\u0142owo, aby w pe\u0142ni zrozumie\u0107 ka\u017cdy wpis w tablicy.<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Gdy dysk jest skonfigurowany jako dysk GPT, pierwsz\u0105 partycj\u0105, kt\u00f3ra zostanie utworzona, jest partycja systemowa EFI (ESP). Jest to ukryta partycja, kt\u00f3ra nie jest \u0142atwo dost\u0119pna dla u\u017cytkownik\u00f3w. Partycja ta znajduje si\u0119 w sektorze 2048 i jest sformatowana jako FAT32 w celu zapewnienia kompatybilno\u015bci ze wszystkimi systemami (Windows, Linux, MacOS).<\/p>\n

<\/p>\n

Powy\u017cszy zrzut ekranu przedstawia standardow\u0105 instalacj\u0119 systemu Windows 10, w kt\u00f3rej utworzono partycj\u0119 Microsoft Reserved wraz z jedn\u0105 partycj\u0105 danych podstawowych okre\u015blon\u0105 przez u\u017cytkownika podczas instalacji.<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Poni\u017cej znajduje si\u0119 fragment identyfikator\u00f3w GUID z tabeli znalezionej na stronie Wikipedii GUID Partition Table:<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

\u0179r\u00f3d\u0142o: https:\/\/en.wikipedia.org\/wiki\/GUID_Partition_Table#Partition_type_GUIDs<\/a><\/p>\n

<\/p>\n

Oczywi\u015bcie identyfikator GUID nie zostanie zapisany w formularzu GUID podczas przegl\u0105dania warto\u015bci w przegl\u0105darce szesnastkowej.\u00a0<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Identyfikatory GUID s\u0105 konwertowane tak samo, jak w poprzednim wpisie na blogu, ale mo\u017cna je r\u00f3wnie\u017c \u0142atwo zobaczy\u0107 podczas przegl\u0105dania w HxD:<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Mo\u017cemy potwierdzi\u0107 identyfikatory GUID partycji woluminu za pomoc\u0105 polecenia: mountvol.exe<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Znaj\u0105c pocz\u0105tkowy LBA i ko\u0144cowy LBA, mo\u017cemy obliczy\u0107 rozmiar partycji. Na przyk\u0142ad partycja EFI:<\/p>\n

<\/p>\n

Pocz\u0105tkowy LBA: 2048<\/p>\n

<\/p>\n

Ko\u0144cowe LBA: 534527<\/p>\n

<\/p>\n

Ca\u0142kowita d\u0142ugo\u015b\u0107: 532479 sektor\u00f3w x 512 bajt\u00f3w\/sektor = 272629248 bajt\u00f3w, czyli 260 MB.<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Zapasowa tablica wpis\u00f3w partycji GPT<\/h2>\n

<\/p>\n

Backup GPT Partition Entry Array znajduje si\u0119 na ko\u0144cu dysku i przed nag\u0142\u00f3wkiem GPT, a konkretnie 33 sektory przed ko\u0144cem dysku (LBA (n - 33), gdzie n to ostatni sektor dysku). Mo\u017cemy r\u00f3wnie\u017c obliczy\u0107, dlaczego jest to 33 sektory przed ko\u0144cem dysku lub 32 sektory przed nag\u0142\u00f3wkiem kopii zapasowej GPT.<\/p>\n

<\/p>\n

Ka\u017cdy wpis partycji ma 128 bajt\u00f3w, a ca\u0142kowita liczba wpis\u00f3w w tablicy wpis\u00f3w wynosi 128. Oznacza to, \u017ce w tablicy znajduj\u0105 si\u0119 16 384 sektory lub 32 sektory (16384\/512).\u00a0<\/p>\n

<\/p>\n

Nag\u0142\u00f3wek GPT kopii zapasowej wskazuje lokalizacj\u0119 tablicy wpis\u00f3w partycji GPT kopii zapasowej<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Kopia zapasowa tablicy wpis\u00f3w partycji GPT w pobli\u017cu ko\u0144ca dysku<\/p>\n

<\/p>\n

Naprawianie tablicy wpis\u00f3w partycji GPT<\/h2>\n

<\/p>\n

Naprawa tablicy wpis\u00f3w partycji GPT jest tak prosta, jak skopiowanie 16 384-bajtowej kopii zapasowej znalezionych 33 sektor\u00f3w z ko\u0144ca dysku i wklejenie ich w LBA 2 do 3. Nie ma potrzeby \u017cadnych zmian\/modyfikacji warto\u015bci szesnastkowych, poniewa\u017c s\u0105 to dok\u0142adne kopie.<\/p>\n

<\/p>\n

Kopia zapasowa GPT znajduj\u0105ca si\u0119 na ko\u0144cu dysku jest taka sama jak podstawowa. W rzeczywisto\u015bci wyci\u0119cie sektor\u00f3w dla ka\u017cdego z nich i ich haszowanie pokazuje, \u017ce s\u0105 one dok\u0142adnie takie same.\u00a0<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Wnioski<\/h2>\n

<\/p>\n

W tej trzeciej cz\u0119\u015bci dok\u0142adnie zbadali\u015bmy tablic\u0119 wpis\u00f3w partycji GPT, krytyczny sk\u0142adnik schematu GPT. Rozbijaj\u0105c ka\u017cde pole we wpisach partycji, od identyfikator\u00f3w GUID po bity atrybut\u00f3w i nazwy partycji, zobaczyli\u015bmy, w jaki spos\u00f3b GPT zapewnia solidn\u0105 struktur\u0119 do organizowania i uzyskiwania dost\u0119pu do danych na dysku. Wiedza ta jest niezb\u0119dna do prowadzenia dochodze\u0144 kryminalistycznych, odzyskiwania danych i administrowania systemem, wyposa\u017caj\u0105c ci\u0119 w umiej\u0119tno\u015bci efektywnej nawigacji i manipulowania dyskami z partycjami GPT. B\u0105d\u017a na bie\u017c\u0105co z naszym nast\u0119pnym postem, w kt\u00f3rym zag\u0142\u0119bimy si\u0119 w praktyczne zastosowania i studia przypadk\u00f3w, przenosz\u0105c teori\u0119 w praktyk\u0119.<\/p>\n

Ten post ko\u0144czy nasz\u0105 3-cz\u0119\u015bciow\u0105 seri\u0119 na temat struktur partycji GPT.<\/strong>
Je\u015bli przegapi\u0142e\u015b wcze\u015bniejsze posty, zacznij od Cz\u0119\u015b\u0107 1 - Ochronny MBR<\/strong><\/a>gdzie badamy, w jaki spos\u00f3b utrzymywana jest kompatybilno\u015b\u0107 ze starszymi wersjami, i kontynuujemy z Cz\u0119\u015b\u0107 2 - Nag\u0142\u00f3wek GPT<\/strong><\/a>kt\u00f3ry definiuje uk\u0142ad dysku i zapewnia integralno\u015b\u0107.<\/p>\n

Chcesz dowiedzie\u0107 si\u0119 wi\u0119cej? Zapisz si\u0119 do naszego newslettera, aby uzyska\u0107 dost\u0119p do nadchodz\u0105cych tre\u015bci na temat odzyskiwania partycji, haszowania na poziomie dysku i wyzwa\u0144 CTF opartych na rzeczywistych scenariuszach kryminalistycznych.<\/p>\n

<\/p>\n

<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

Uzyskaj g\u0142\u0119bsze zrozumienie tablicy wpis\u00f3w partycji GPT i jej znaczenia w cyfrowej analizie kryminalistycznej. W tym przewodniku om\u00f3wiono kluczowe techniki i spostrze\u017cenia w celu usprawnienia dochodze\u0144 kryminalistycznych.<\/p>","protected":false},"author":1,"featured_media":580,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[19],"tags":[],"class_list":["post-922","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digital-forensics"],"acf":[],"yoast_head":"\nNavigating the GPT Partition Entry Array for Forensic Analysis. Part 3. - Elusive Data<\/title>\n<meta name=\"description\" content=\"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/pl\/3-2\/\" \/>\n<meta property=\"og:locale\" content=\"pl_PL\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.\" \/>\n<meta property=\"og:description\" content=\"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/pl\/3-2\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-22T16:07:40+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:35+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1707\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Napisane przez\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Szacowany czas czytania\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minut\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.\",\"datePublished\":\"2024-11-22T16:07:40+00:00\",\"dateModified\":\"2025-07-18T18:04:35+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\"},\"wordCount\":919,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD3-1-scaled.jpg\",\"articleSection\":[\"Digital Forensics\"],\"inLanguage\":\"pl-PL\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\",\"name\":\"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3. - Elusive Data\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD3-1-scaled.jpg\",\"datePublished\":\"2024-11-22T16:07:40+00:00\",\"dateModified\":\"2025-07-18T18:04:35+00:00\",\"description\":\"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#breadcrumb\"},\"inLanguage\":\"pl-PL\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pl-PL\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD3-1-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD3-1-scaled.jpg\",\"width\":2560,\"height\":1707,\"caption\":\"Hard disk drive \u2014 digital forensics evidence storage device analysis\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pl-PL\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pl-PL\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pl-PL\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/pl\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Poruszanie si\u0119 po tablicy wpis\u00f3w partycji GPT na potrzeby analizy kryminalistycznej. Cz\u0119\u015b\u0107 3. - Nieuchwytne dane","description":"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/pl\/3-2\/","og_locale":"pl_PL","og_type":"article","og_title":"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.","og_description":"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.","og_url":"https:\/\/elusivedata.io\/pl\/3-2\/","og_site_name":"Elusive Data","article_published_time":"2024-11-22T16:07:40+00:00","article_modified_time":"2025-07-18T18:04:35+00:00","og_image":[{"width":2560,"height":1707,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","type":"image\/jpeg"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_misc":{"Napisane przez":"James Eichbaum","Szacowany czas czytania":"7 minut"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/3-2\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/3-2\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.","datePublished":"2024-11-22T16:07:40+00:00","dateModified":"2025-07-18T18:04:35+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/3-2\/"},"wordCount":919,"commentCount":1,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/3-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","articleSection":["Digital Forensics"],"inLanguage":"pl-PL","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/3-2\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/3-2\/","url":"https:\/\/elusivedata.io\/3-2\/","name":"Poruszanie si\u0119 po tablicy wpis\u00f3w partycji GPT na potrzeby analizy kryminalistycznej. Cz\u0119\u015b\u0107 3. - Nieuchwytne dane","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/3-2\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/3-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","datePublished":"2024-11-22T16:07:40+00:00","dateModified":"2025-07-18T18:04:35+00:00","description":"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/3-2\/#breadcrumb"},"inLanguage":"pl-PL","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/3-2\/"]}]},{"@type":"ImageObject","inLanguage":"pl-PL","@id":"https:\/\/elusivedata.io\/3-2\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","width":2560,"height":1707,"caption":"Hard disk drive \u2014 digital forensics evidence storage device analysis"},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/3-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3."}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"ElusiveData","description":"Doskona\u0142o\u015b\u0107 w zakresie szkole\u0144 i doradztwa w dziedzinie informatyki \u015bledczej","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pl-PL"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"ElusiveData","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"pl-PL","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"pl-PL","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/pl\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/posts\/922","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/comments?post=922"}],"version-history":[{"count":9,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/posts\/922\/revisions"}],"predecessor-version":[{"id":7455,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/posts\/922\/revisions\/7455"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/media\/580"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/media?parent=922"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/categories?post=922"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/pl\/wp-json\/wp\/v2\/tags?post=922"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}