{"id":918,"date":"2024-11-22T16:04:21","date_gmt":"2024-11-22T16:04:21","guid":{"rendered":"https:\/\/elusivedata.io\/?p=918"},"modified":"2025-07-18T18:04:38","modified_gmt":"2025-07-18T18:04:38","slug":"1-2","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/pt\/1-2\/","title":{"rendered":"Entendendo o MBR de prote\u00e7\u00e3o em discos particionados GPT. Parte 1."},"content":{"rendered":"<h1 class=\"wp-block-heading\" id=\"h-introduction\">Introdu\u00e7\u00e3o<\/h1>\n\n\n\n<p>Nesta s\u00e9rie de publica\u00e7\u00f5es no blogue, vou aprofundar o esquema da tabela de parti\u00e7\u00e3o GUID. O meu objetivo \u00e9 fornecer uma compreens\u00e3o clara do esquema GPT e de como este permite aos investigadores forenses analisar e recuperar com precis\u00e3o os dados de dispositivos de armazenamento modernos. O suporte da GPT para discos maiores, v\u00e1rias parti\u00e7\u00f5es e funcionalidades de integridade de dados melhoradas, como a redund\u00e2ncia e a prote\u00e7\u00e3o CRC, garante que os investigadores podem aceder e verificar todos os dados necess\u00e1rios. Al\u00e9m disso, a compatibilidade da GPT com sistemas operativos contempor\u00e2neos e firmware UEFI aumenta a capacidade de realizar exames forenses abrangentes, tornando-a indispens\u00e1vel para descobrir provas digitais e garantir a integridade e fiabilidade das descobertas forenses.&nbsp;<\/p>\n\n\n\n<p>Come\u00e7arei com o MBR Protective e como ele difere do MBR tradicional usado com unidades legadas no BIOS. Em seguida, apresentarei o cabe\u00e7alho GPT e, depois, a matriz de entrada GPT. Por fim, partilharei algumas considera\u00e7\u00f5es finais e dicas sobre como explicar estes conceitos a um leigo, por exemplo, ao testemunhar perante um juiz ou j\u00fari.<\/p>\n\n\n\n<p>Em \u00faltima an\u00e1lise, depois de ler esta s\u00e9rie, n\u00e3o ter\u00e1 qualquer problema em enfrentar um desafio CTF encontrado na nossa plataforma CTF.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"h-part-1\">PARTE 1<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-the-protective-mbr\">O MBR de prote\u00e7\u00e3o<\/h2>\n\n\n\n<p>O Master Boot Record (MBR), de um ponto de vista legado, forneceu-nos um roteiro para localizar at\u00e9 quatro parti\u00e7\u00f5es prim\u00e1rias num disco r\u00edgido. Cada entrada de parti\u00e7\u00e3o de 16 bytes guiava-nos para a localiza\u00e7\u00e3o dessa parti\u00e7\u00e3o, quer fosse FAT32 ou NTFS. No entanto, o antigo MBR tinha limita\u00e7\u00f5es, incluindo, mas n\u00e3o se limitando a:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Um limite de tamanho de 2 TB.<\/li>\n\n\n\n<li>Limitado a 4 parti\u00e7\u00f5es prim\u00e1rias; se forem necess\u00e1rias mais, uma dessas parti\u00e7\u00f5es prim\u00e1rias ser\u00e1 designada como uma parti\u00e7\u00e3o alargada.<\/li>\n\n\n\n<li>Um \u00fanico ponto de falha, uma vez que o MBR, que inclui a tabela de parti\u00e7\u00f5es, estava localizado no sector 0 sem qualquer c\u00f3pia de seguran\u00e7a.<\/li>\n<\/ul>\n\n\n\n<p>O LBA 0 (setor l\u00f3gico 0) de um disco r\u00edgido GPT cont\u00e9m o que \u00e9 chamado de MBR de Prote\u00e7\u00e3o, em vez de MBR legado. Pense no MBR de Prote\u00e7\u00e3o como uma placa na entrada da biblioteca que diz a todos: \"Ei, esta biblioteca est\u00e1 usando um sistema novo e melhorado agora. N\u00e3o use o m\u00e9todo antigo porque ele n\u00e3o funciona aqui\".<\/p>\n\n\n\n<p>Em vez de conter a localiza\u00e7\u00e3o de apenas quatro parti\u00e7\u00f5es prim\u00e1rias na unidade, o MBR Protetor marca todo o disco como utilizado pela GPT, indicando aos sistemas mais antigos que o disco est\u00e1 a ser totalmente utilizado. O MBR de Prote\u00e7\u00e3o existe apenas para compatibilidade com vers\u00f5es anteriores. Ele cont\u00e9m APENAS uma entrada de parti\u00e7\u00e3o, que marca o disco e evita que ferramentas legadas interpretem erroneamente a estrutura do disco.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-structure-of-the-protective-mbr\">Estrutura do MBR de prote\u00e7\u00e3o<\/h3>\n\n\n\n<p>Os primeiros 440 bytes do MBR de prote\u00e7\u00e3o cont\u00eam c\u00f3digo de arranque que n\u00e3o \u00e9 utilizado pelos sistemas UEFI. Ele \u00e9 ignorado.&nbsp;&nbsp;<\/p>\n\n\n\n<p>Abaixo est\u00e1 um layout hipot\u00e9tico de um disco com uma nova instala\u00e7\u00e3o do Windows 10 com apenas uma parti\u00e7\u00e3o criada durante o processo de instala\u00e7\u00e3o, a unidade C:. A parti\u00e7\u00e3o UEFI System \u00e9 criada automaticamente e oculta do utilizador, e a parti\u00e7\u00e3o reservada da Microsoft tamb\u00e9m \u00e9 criada durante a instala\u00e7\u00e3o e oculta do utilizador.&nbsp;<\/p>\n\n\n\n<p>Aqui podemos ver o MBR de prote\u00e7\u00e3o a residir no LBA 0, que aponta para o cabe\u00e7alho GPT no LBA 1.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img fetchpriority=\"high\" decoding=\"async\" width=\"740\" height=\"164\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1.png\" alt=\"\" class=\"wp-image-924\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1.png 740w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1-600x133.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1-300x66.png 300w\" sizes=\"(max-width: 740px) 100vw, 740px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-hex-layout-of-the-protective-mbr\">Disposi\u00e7\u00e3o hexagonal do MBR de prote\u00e7\u00e3o<\/h3>\n\n\n\n<p>Aqui est\u00e1 um exemplo de layout hexadecimal do MBR de prote\u00e7\u00e3o:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"751\" height=\"650\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1.png\" alt=\"\" class=\"wp-image-925\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1.png 751w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1-600x519.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1-300x260.png 300w\" sizes=\"(max-width: 751px) 100vw, 751px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"749\" height=\"159\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1.png\" alt=\"\" class=\"wp-image-926\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1.png 749w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1-600x127.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1-300x64.png 300w\" sizes=\"(max-width: 749px) 100vw, 749px\" \/><\/figure>\n\n\n\n<p>Como mencionado anteriormente, os primeiros 440 bytes do c\u00f3digo de inicializa\u00e7\u00e3o n\u00e3o s\u00e3o usados pelos sistemas UEFI. \u00c9 poss\u00edvel ver esses primeiros 440 bytes zerados em alguns sistemas. Aqui est\u00e1 o MBR Protective da esta\u00e7\u00e3o de trabalho que estou a utilizar para escrever este blogue, onde estou a utilizar uma unidade NVME Samsung de 1TB:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"811\" height=\"814\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2.png\" alt=\"\" class=\"wp-image-928\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2.png 811w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-300x300.png 300w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-100x100.png 100w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-600x602.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-150x150.png 150w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-768x771.png 768w\" sizes=\"(max-width: 811px) 100vw, 811px\" \/><\/figure>\n\n\n\n<p>Como pode ver, a totalidade do MBR Protetor neste caso cont\u00e9m zeros exceto os quatro bytes localizados no offset 440 (que n\u00e3o s\u00e3o utilizados), a primeira \"entrada de parti\u00e7\u00e3o prim\u00e1ria\" (que apenas aponta para o LBA 1 - o Cabe\u00e7alho GPT), e a assinatura de arranque localizada nos \u00faltimos dois bytes do sector (0x55AA).&nbsp;<\/p>\n\n\n\n<p>Agora vamos dar uma olhada mais de perto na entrada de uma parti\u00e7\u00e3o que existe em um MBR Protetor:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"748\" height=\"647\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3.png\" alt=\"\" class=\"wp-image-929\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3.png 748w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3-600x519.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3-300x259.png 300w\" sizes=\"(max-width: 748px) 100vw, 748px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"752\" height=\"138\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2.png\" alt=\"\" class=\"wp-image-930\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2.png 752w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2-600x110.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2-300x55.png 300w\" sizes=\"(max-width: 752px) 100vw, 752px\" \/><\/figure>\n\n\n\n<p>O primeiro byte da entrada da parti\u00e7\u00e3o \u00e9 definido como 0x00 para indicar que n\u00e3o \u00e9 uma parti\u00e7\u00e3o inicializ\u00e1vel. Em um MBR tradicional, este valor seria 0x00 (n\u00e3o inicializ\u00e1vel) ou 0x80 (inicializ\u00e1vel). Os pr\u00f3ximos tr\u00eas bytes representam o <strong>In\u00edcio da CHS <\/strong>localiza\u00e7\u00e3o (Cilindro\/Cabe\u00e7a\/Setor), que corresponder\u00e1 ao valor de 4 bytes no <strong>In\u00edcio do LBA<\/strong> no desvio de byte 8. O valor CHS inicial ser\u00e1 definido como <strong>0x000200<\/strong> que, quando decomposto e convertido num endere\u00e7o LBA, \u00e9 1.<\/p>\n\n\n\n<p>O seguinte valor de um byte \u00e9 definido como <strong>0xEE<\/strong> para o tipo de SO: <strong>Prote\u00e7\u00e3o GPT<\/strong>. O valor de tr\u00eas bytes no offset 5 \u00e9 definido como o endere\u00e7o CHS do \u00faltimo bloco l\u00f3gico no disco. O LBA inicial, que nos leva ao Cabe\u00e7alho de Parti\u00e7\u00e3o GPT, est\u00e1 localizado no deslocamento 8 para quatro bytes e o valor ser\u00e1 definido como <strong>0x01000000<\/strong> (ou LBA 1 quando lido em little endian). Os \u00faltimos 4 bytes do registo no offset 12 representam o tamanho do disco menos um. \u00c9 definido como <strong>0xFFFFFFFF<\/strong> se o tamanho do disco for demasiado grande para ser representado neste campo, o que \u00e9 muito provavelmente o caso.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-repairing-a-protective-mrb\">Repara\u00e7\u00e3o de uma MRB de prote\u00e7\u00e3o<\/h3>\n\n\n\n<p>Se o MBR foi corrompido, perdido ou apagado, voc\u00ea pode substituir o setor 0 copiando o MBR de Prote\u00e7\u00e3o de outro drive. Tamb\u00e9m pode criar um de raiz, deixando 0x00 do offset 0 at\u00e9 446, e depois criar uma entrada de parti\u00e7\u00e3o gen\u00e9rica apontando para o LBA 1, assegurando que existe 0xEE no offset 4 para indicar o tipo de SO Protetor GPT. Finalmente, coloque a assinatura de arranque (0x55AA) nos \u00faltimos dois bytes do sector.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-generic-entry\"><em>Entrada gen\u00e9rica<\/em><\/h4>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>446<\/td><td>447<\/td><td>448<\/td><td>449<\/td><td>450<\/td><td>451<\/td><td>452<\/td><td>453<\/td><td>454<\/td><td>455<\/td><td>456<\/td><td>457<\/td><td>458<\/td><td>459<\/td><td>460<\/td><td>461<\/td><\/tr><tr><td>00<\/td><td>00<\/td><td>02<\/td><td>00<\/td><td>EE<\/td><td>FF<\/td><td>FF<\/td><td>FF<\/td><td>01<\/td><td>00<\/td><td>00<\/td><td>00<\/td><td>FF<\/td><td>FF<\/td><td>FF<\/td><td>FF<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-boot-signature\"><em>Assinatura da bota<\/em><\/h4>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>510<\/td><td>511<\/td><\/tr><tr><td>55<\/td><td>AA<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>O seguinte seria suficiente para um MBR Protetor reconstru\u00eddo:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"508\" height=\"449\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD4.png\" alt=\"\" class=\"wp-image-932\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD4.png 508w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD4-300x265.png 300w\" sizes=\"(max-width: 508px) 100vw, 508px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-conclusion\">Conclus\u00e3o<\/h2>\n\n\n\n<p>Nesta primeira parte, n\u00f3s exploramos o MBR Protetor e seu papel crucial em garantir a compatibilidade com sistemas legados. Examinamos como o MBR Protetor marca todo o disco como usado pelo GPT, evitando que sistemas mais antigos interpretem erroneamente a estrutura do disco. Ao entender a estrutura e a fun\u00e7\u00e3o do MBR de prote\u00e7\u00e3o, voc\u00ea agora tem uma base s\u00f3lida para se aprofundar no esquema GPT.<\/p>\n\n\n\n<p>\u00c0 medida que avan\u00e7amos, nosso pr\u00f3ximo foco ser\u00e1 o Cabe\u00e7alho GPT, a pedra angular do esquema GPT que define o layout do disco e garante a integridade dos dados. Na Parte 2, analisaremos o Cabe\u00e7alho GPT, examinando cada campo e seu significado. Fique atento \u00e0 medida que continuamos a desvendar as complexidades do esquema GPT, capacitando-o com o conhecimento para gerir e recuperar eficazmente os dados de dispositivos de armazenamento modernos.<\/p>\n\n\n\n<p><strong>Quer aprofundar a estrutura GPT?<br><\/strong><br>Em <a class=\"\" href=\"https:\/\/elusivedata.io\/pt\/2-2\/\"><strong>Parte 2<\/strong><\/a>, decompomos o <strong>Cabe\u00e7alho GPT<\/strong> e explicar como garante a integridade dos dados no disco.<br>Depois, em <a class=\"\" href=\"https:\/\/elusivedata.io\/pt\/3-2\/\"><strong>Parte 3<\/strong><\/a>, exploramos o <strong>Matriz de entrada de parti\u00e7\u00e3o GPT<\/strong> e o que os analistas forenses precisam de saber ao reconstruir tabelas de parti\u00e7\u00e3o.<\/p>","protected":false},"excerpt":{"rendered":"<p>Explore a fun\u00e7\u00e3o do MBR de prote\u00e7\u00e3o em discos particionados GPT. Este guia investiga a sua finalidade, funcionalidade e import\u00e2ncia nas investiga\u00e7\u00f5es forenses digitais.<\/p>","protected":false},"author":1,"featured_media":748,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"blog-post","footnotes":""},"categories":[19],"tags":[],"class_list":["post-918","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digital-forensics"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.3 (Yoast SEO v27.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Understanding the Protective MBR in GPT-Partitioned Disks. Part 1. - Elusive Data<\/title>\n<meta name=\"description\" content=\"Learn how the Protective MBR works in GPT-partitioned disks and why it matters in digital forensic investigations. Part 1 of our deep-dive series.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/pt\/1-2\/\" \/>\n<meta property=\"og:locale\" content=\"pt_PT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Understanding the Protective MBR in GPT-Partitioned Disks.\" \/>\n<meta property=\"og:description\" content=\"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/pt\/1-2\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-22T16:04:21+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46-1024x675.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Understanding the Protective MBR in GPT-Partitioned Disks.\" \/>\n<meta name=\"twitter:description\" content=\"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tempo estimado de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1.\",\"datePublished\":\"2024-11-22T16:04:21+00:00\",\"dateModified\":\"2025-07-18T18:04:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\"},\"wordCount\":1133,\"commentCount\":5,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"articleSection\":[\"Digital Forensics\"],\"inLanguage\":\"pt-PT\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\",\"name\":\"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1. - Elusive Data\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"datePublished\":\"2024-11-22T16:04:21+00:00\",\"dateModified\":\"2025-07-18T18:04:38+00:00\",\"description\":\"Learn how the Protective MBR works in GPT-partitioned disks and why it matters in digital forensic investigations. Part 1 of our deep-dive series.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#breadcrumb\"},\"inLanguage\":\"pt-PT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-PT\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"width\":2662,\"height\":1754,\"caption\":\"Close-up of a hard disk drive, used to illustrate GPT disk structure in digital forensics.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-PT\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-PT\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-PT\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/pt\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Entendendo o MBR de prote\u00e7\u00e3o em discos particionados GPT. Parte 1. - Dados Elusivos","description":"Saiba como o MBR de prote\u00e7\u00e3o funciona em discos com parti\u00e7\u00f5es GPT e porque \u00e9 importante em investiga\u00e7\u00f5es forenses digitais. Parte 1 da nossa s\u00e9rie de aprofundamento.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/pt\/1-2\/","og_locale":"pt_PT","og_type":"article","og_title":"Understanding the Protective MBR in GPT-Partitioned Disks.","og_description":"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.","og_url":"https:\/\/elusivedata.io\/pt\/1-2\/","og_site_name":"Elusive Data","article_published_time":"2024-11-22T16:04:21+00:00","article_modified_time":"2025-07-18T18:04:38+00:00","og_image":[{"width":1024,"height":675,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46-1024x675.png","type":"image\/png"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_title":"Understanding the Protective MBR in GPT-Partitioned Disks.","twitter_description":"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.","twitter_image":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","twitter_misc":{"Escrito por":"James Eichbaum","Tempo estimado de leitura":"7 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/1-2\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/1-2\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1.","datePublished":"2024-11-22T16:04:21+00:00","dateModified":"2025-07-18T18:04:38+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/1-2\/"},"wordCount":1133,"commentCount":5,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","articleSection":["Digital Forensics"],"inLanguage":"pt-PT","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/1-2\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/1-2\/","url":"https:\/\/elusivedata.io\/1-2\/","name":"Entendendo o MBR de prote\u00e7\u00e3o em discos particionados GPT. Parte 1. - Dados Elusivos","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","datePublished":"2024-11-22T16:04:21+00:00","dateModified":"2025-07-18T18:04:38+00:00","description":"Saiba como o MBR de prote\u00e7\u00e3o funciona em discos com parti\u00e7\u00f5es GPT e porque \u00e9 importante em investiga\u00e7\u00f5es forenses digitais. Parte 1 da nossa s\u00e9rie de aprofundamento.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/1-2\/#breadcrumb"},"inLanguage":"pt-PT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/1-2\/"]}]},{"@type":"ImageObject","inLanguage":"pt-PT","@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","width":2662,"height":1754,"caption":"Close-up of a hard disk drive, used to illustrate GPT disk structure in digital forensics."},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/1-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1."}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"ElusiveData","description":"Excel\u00eancia em forma\u00e7\u00e3o e consultoria forense digital","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-PT"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"ElusiveData","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"pt-PT","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"pt-PT","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/pt\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/posts\/918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/comments?post=918"}],"version-history":[{"count":7,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/posts\/918\/revisions"}],"predecessor-version":[{"id":7450,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/posts\/918\/revisions\/7450"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/media\/748"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/media?parent=918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/categories?post=918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/tags?post=918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}