{"id":922,"date":"2024-11-22T16:07:40","date_gmt":"2024-11-22T16:07:40","guid":{"rendered":"https:\/\/elusivedata.io\/?p=922"},"modified":"2025-07-18T18:04:35","modified_gmt":"2025-07-18T18:04:35","slug":"3-2","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/pt\/3-2\/","title":{"rendered":"Navegando na matriz de entrada de parti\u00e7\u00e3o GPT para an\u00e1lise forense. Parte 3."},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>\n

Parte 3<\/h1>\n

<\/p>\n

Introdu\u00e7\u00e3o<\/h2>\n

<\/p>\n

Em nossas postagens anteriores, estabelecemos as bases para entender a Tabela de parti\u00e7\u00e3o GUID (GPT) examinando o MBR de prote\u00e7\u00e3o e o Cabe\u00e7alho GPT. Agora, na Parte 3, voltamos nosso foco para a Matriz de Entrada de Parti\u00e7\u00e3o GPT. Este componente crucial do esquema GPT fornece um mapa detalhado de todas as parti\u00e7\u00f5es no disco, cada entrada contendo informa\u00e7\u00f5es vitais sobre uma parti\u00e7\u00e3o espec\u00edfica. Ao compreender a estrutura e a fun\u00e7\u00e3o da Matriz de entradas de parti\u00e7\u00e3o GPT, obter\u00e1 uma vis\u00e3o abrangente de como o GPT gere as parti\u00e7\u00f5es, permitindo uma an\u00e1lise, resolu\u00e7\u00e3o de problemas e recupera\u00e7\u00e3o de dados mais eficazes.<\/p>\n

<\/p>\n

GPT (Tabela de parti\u00e7\u00e3o GUID) Matriz de entradas de parti\u00e7\u00e3o<\/h2>\n

<\/p>\n

A matriz de entrada da tabela de parti\u00e7\u00e3o GUID (GPT) \u00e9 uma parte cr\u00edtica do sistema de particionamento GPT, que \u00e9 usado para definir e gerenciar as parti\u00e7\u00f5es em um disco r\u00edgido. Pense nela como uma lista detalhada que registra as especificidades de cada parti\u00e7\u00e3o no disco, como o cat\u00e1logo de uma biblioteca que lista os detalhes de cada livro.<\/p>\n

<\/p>\n

Componentes principais da matriz de entrada GPT:<\/h3>\n

<\/p>\n

GUID da parti\u00e7\u00e3o<\/strong>: Cada parti\u00e7\u00e3o tem um identificador \u00fanico, conhecido como GUID da parti\u00e7\u00e3o, que garante que cada parti\u00e7\u00e3o pode ser identificada de forma \u00fanica, mesmo em sistemas diferentes.<\/p>\n

<\/p>\n

ID \u00fanico<\/strong>: Este \u00e9 outro identificador \u00fanico espec\u00edfico de cada parti\u00e7\u00e3o, fornecendo uma camada adicional de identifica\u00e7\u00e3o \u00fanica.<\/p>\n

<\/p>\n

Iniciando o LBA (Logical Block Addressing) da parti\u00e7\u00e3o<\/strong>: Indica o ponto de partida da parti\u00e7\u00e3o no disco. Diz ao sistema onde a parti\u00e7\u00e3o come\u00e7a.<\/p>\n

<\/p>\n

LBA final da parti\u00e7\u00e3o<\/strong>: Tal como o LBA inicial, indica onde a parti\u00e7\u00e3o termina no disco.<\/p>\n

<\/p>\n

Bits de atributo<\/strong>: S\u00e3o flags que fornecem informa\u00e7\u00f5es adicionais sobre a parti\u00e7\u00e3o, tais como se ela \u00e9 inicializ\u00e1vel ou se possui algum atributo especial.<\/p>\n

<\/p>\n

Nome da parti\u00e7\u00e3o<\/strong>: Cada parti\u00e7\u00e3o pode ter um nome leg\u00edvel por humanos, facilitando a identifica\u00e7\u00e3o do objetivo ou do conte\u00fado da parti\u00e7\u00e3o. Este nome \u00e9 terminado com um car\u00e1cter nulo para marcar o fim da cadeia de caracteres.<\/p>\n

<\/p>\n

Vamos analisar tudo isto em pormenor para que compreenda perfeitamente cada entrada na matriz.<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Quando o disco \u00e9 configurado como um disco GPT, a primeira parti\u00e7\u00e3o que ser\u00e1 criada \u00e9 a EFI System Partition (ESP). Esta \u00e9 uma parti\u00e7\u00e3o oculta que n\u00e3o est\u00e1 prontamente dispon\u00edvel para os utilizadores. Esta parti\u00e7\u00e3o ser\u00e1 encontrada no sector 2048 e est\u00e1 formatada como FAT32 para compatibilidade com todos os sistemas (Windows, Linux, MacOS).<\/p>\n

<\/p>\n

A captura de ecr\u00e3 acima mostra uma instala\u00e7\u00e3o padr\u00e3o do Windows 10 em que a Parti\u00e7\u00e3o Reservada da Microsoft foi criada juntamente com uma Parti\u00e7\u00e3o de Dados B\u00e1sicos que foi especificada pelo utilizador durante a instala\u00e7\u00e3o.<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Abaixo est\u00e1 um excerto de GUIDs de uma tabela encontrada na p\u00e1gina da Wikip\u00e9dia Tabela de parti\u00e7\u00e3o GUID:<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Fonte: https:\/\/en.wikipedia.org\/wiki\/GUID_Partition_Table#Partition_type_GUIDs<\/a><\/p>\n

<\/p>\n

Naturalmente, o GUID n\u00e3o ser\u00e1 armazenado no formul\u00e1rio GUIID quando se visualizam os valores no visualizador hexadecimal.\u00a0<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Os GUIDs s\u00e3o convertidos tal como fizemos na publica\u00e7\u00e3o anterior do blogue, mas tamb\u00e9m podem ser facilmente vistos quando o visualizamos em HxD:<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Podemos confirmar os GUIDs da parti\u00e7\u00e3o do volume com o comando: mountvol.exe<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Sabendo o LBA inicial e o LBA final, podemos calcular o tamanho da parti\u00e7\u00e3o. Por exemplo, a parti\u00e7\u00e3o EFI:<\/p>\n

<\/p>\n

LBA inicial: 2048<\/p>\n

<\/p>\n

Fim do LBA: 534527<\/p>\n

<\/p>\n

Comprimento total: 532479 sectores x 512 bytes\/sector = 272629248 bytes, ou seja, 260 MB.<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

A matriz de entrada de parti\u00e7\u00e3o GPT de backup<\/h2>\n

<\/p>\n

A matriz de entrada da parti\u00e7\u00e3o GPT de backup est\u00e1 localizada no final do disco e antes do cabe\u00e7alho GPT, especificamente 33 setores antes do final do disco (LBA (n - 33) onde n \u00e9 o \u00faltimo setor do disco). Tamb\u00e9m podemos fazer alguns c\u00e1lculos para saber por que raz\u00e3o s\u00e3o 33 sectores antes do fim do disco, ou 32 sectores antes do Cabe\u00e7alho GPT de c\u00f3pia de seguran\u00e7a.<\/p>\n

<\/p>\n

Cada entrada de parti\u00e7\u00e3o tem 128 bytes e h\u00e1 um total de 128 entradas na matriz de entradas. Isto significa que existem 16.384 sectores na matriz ou 32 sectores (16384\/512).\u00a0<\/p>\n

<\/p>\n

O Cabe\u00e7alho GPT de C\u00f3pia de Seguran\u00e7a aponta para a localiza\u00e7\u00e3o da Matriz de Entrada de Parti\u00e7\u00e3o GPT de C\u00f3pia de Seguran\u00e7a<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Matriz de entrada de parti\u00e7\u00e3o GPT de backup perto do fim do disco<\/p>\n

<\/p>\n

Repara\u00e7\u00e3o de uma matriz de entrada de parti\u00e7\u00e3o GPT<\/h2>\n

<\/p>\n

Reparar a matriz de entrada de parti\u00e7\u00e3o GPT \u00e9 t\u00e3o simples como copiar a c\u00f3pia de seguran\u00e7a de 16.384 bytes encontrada em 33 sectores a partir do fim do disco e col\u00e1-la nos LBA 2 a 3. N\u00e3o h\u00e1 necessidade de qualquer altera\u00e7\u00e3o\/modifica\u00e7\u00e3o dos valores hexadecimais, uma vez que se trata de c\u00f3pias exactas.<\/p>\n

<\/p>\n

O GPT de backup localizado pr\u00f3ximo ao final do disco \u00e9 o mesmo que o prim\u00e1rio. De facto, ao esculpir os sectores de cada um deles e ao fazer o hashing, verifica-se que s\u00e3o exatamente iguais.\u00a0<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Conclus\u00e3o<\/h2>\n

<\/p>\n

Nesta terceira parte, examinamos minuciosamente o conjunto de entradas de parti\u00e7\u00e3o GPT, um componente cr\u00edtico do esquema GPT. Ao analisar cada campo dentro das entradas de parti\u00e7\u00e3o, desde os GUIDs at\u00e9 os bits de atributo e nomes de parti\u00e7\u00e3o, vimos como o GPT fornece uma estrutura robusta para organizar e acessar dados de disco. Esse conhecimento \u00e9 essencial para investiga\u00e7\u00f5es forenses, recupera\u00e7\u00e3o de dados e administra\u00e7\u00e3o de sistemas, equipando-o com as habilidades para navegar e manipular discos particionados GPT de forma eficaz. Fique atento ao nosso pr\u00f3ximo post, onde abordaremos aplica\u00e7\u00f5es pr\u00e1ticas e estudos de caso, trazendo a teoria para a pr\u00e1tica.<\/p>\n

Este post conclui nossa s\u00e9rie de 3 partes sobre estruturas de parti\u00e7\u00e3o GPT.<\/strong>
Se n\u00e3o viu as publica\u00e7\u00f5es anteriores, comece por Parte 1 - O MBR de prote\u00e7\u00e3o<\/strong><\/a>, onde exploramos a forma como a compatibilidade com o legado \u00e9 mantida, e continuamos com Parte 2 - O cabe\u00e7alho GPT<\/strong><\/a>que define a disposi\u00e7\u00e3o do disco e garante a integridade.<\/p>\n

Quer ir mais fundo? Subscreva a nossa newsletter para obter os pr\u00f3ximos conte\u00fados sobre recupera\u00e7\u00e3o de parti\u00e7\u00f5es, hashing ao n\u00edvel do disco e desafios CTF baseados em cen\u00e1rios forenses do mundo real.<\/p>\n

<\/p>\n

<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

Obtenha uma compreens\u00e3o mais profunda da matriz de entrada de parti\u00e7\u00e3o GPT e sua import\u00e2ncia na an\u00e1lise forense digital. Este guia explora as principais t\u00e9cnicas e conhecimentos para melhorar as suas investiga\u00e7\u00f5es forenses.<\/p>","protected":false},"author":1,"featured_media":580,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[19],"tags":[],"class_list":["post-922","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digital-forensics"],"acf":[],"yoast_head":"\nNavigating the GPT Partition Entry Array for Forensic Analysis. Part 3. - Elusive Data<\/title>\n<meta name=\"description\" content=\"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/pt\/3-2\/\" \/>\n<meta property=\"og:locale\" content=\"pt_PT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.\" \/>\n<meta property=\"og:description\" content=\"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/pt\/3-2\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-22T16:07:40+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:35+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1707\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tempo estimado de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.\",\"datePublished\":\"2024-11-22T16:07:40+00:00\",\"dateModified\":\"2025-07-18T18:04:35+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\"},\"wordCount\":919,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD3-1-scaled.jpg\",\"articleSection\":[\"Digital Forensics\"],\"inLanguage\":\"pt-PT\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\",\"name\":\"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3. - Elusive Data\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD3-1-scaled.jpg\",\"datePublished\":\"2024-11-22T16:07:40+00:00\",\"dateModified\":\"2025-07-18T18:04:35+00:00\",\"description\":\"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#breadcrumb\"},\"inLanguage\":\"pt-PT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-PT\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD3-1-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD3-1-scaled.jpg\",\"width\":2560,\"height\":1707,\"caption\":\"Hard disk drive \u2014 digital forensics evidence storage device analysis\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-PT\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-PT\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-PT\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/pt\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Navegando na matriz de entrada de parti\u00e7\u00e3o GPT para an\u00e1lise forense. Parte 3. - Dados Elusivos","description":"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/pt\/3-2\/","og_locale":"pt_PT","og_type":"article","og_title":"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.","og_description":"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.","og_url":"https:\/\/elusivedata.io\/pt\/3-2\/","og_site_name":"Elusive Data","article_published_time":"2024-11-22T16:07:40+00:00","article_modified_time":"2025-07-18T18:04:35+00:00","og_image":[{"width":2560,"height":1707,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","type":"image\/jpeg"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_misc":{"Escrito por":"James Eichbaum","Tempo estimado de leitura":"7 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/3-2\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/3-2\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.","datePublished":"2024-11-22T16:07:40+00:00","dateModified":"2025-07-18T18:04:35+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/3-2\/"},"wordCount":919,"commentCount":1,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/3-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","articleSection":["Digital Forensics"],"inLanguage":"pt-PT","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/3-2\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/3-2\/","url":"https:\/\/elusivedata.io\/3-2\/","name":"Navegando na matriz de entrada de parti\u00e7\u00e3o GPT para an\u00e1lise forense. Parte 3. - Dados Elusivos","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/3-2\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/3-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","datePublished":"2024-11-22T16:07:40+00:00","dateModified":"2025-07-18T18:04:35+00:00","description":"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/3-2\/#breadcrumb"},"inLanguage":"pt-PT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/3-2\/"]}]},{"@type":"ImageObject","inLanguage":"pt-PT","@id":"https:\/\/elusivedata.io\/3-2\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","width":2560,"height":1707,"caption":"Hard disk drive \u2014 digital forensics evidence storage device analysis"},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/3-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3."}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"ElusiveData","description":"Excel\u00eancia em forma\u00e7\u00e3o e consultoria forense digital","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-PT"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"ElusiveData","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"pt-PT","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"pt-PT","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/pt\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/posts\/922","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/comments?post=922"}],"version-history":[{"count":9,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/posts\/922\/revisions"}],"predecessor-version":[{"id":7455,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/posts\/922\/revisions\/7455"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/media\/580"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/media?parent=922"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/categories?post=922"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/pt\/wp-json\/wp\/v2\/tags?post=922"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}