{"id":918,"date":"2024-11-22T16:04:21","date_gmt":"2024-11-22T16:04:21","guid":{"rendered":"https:\/\/elusivedata.io\/?p=918"},"modified":"2025-07-18T18:04:38","modified_gmt":"2025-07-18T18:04:38","slug":"1-2","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/sv\/1-2\/","title":{"rendered":"F\u00f6rst\u00e5 den skyddande MBR i GPT-partitionerade diskar. Del 1."},"content":{"rendered":"<h1 class=\"wp-block-heading\" id=\"h-introduction\">Inledning<\/h1>\n\n\n\n<p>I den h\u00e4r serien av blogginl\u00e4gg kommer jag att dyka djupt in i GUID Partition Table Schema. Jag str\u00e4var efter att ge en tydlig f\u00f6rst\u00e5else f\u00f6r GPT-schemat och hur det g\u00f6r det m\u00f6jligt f\u00f6r kriminaltekniska utredare att noggrant analysera och \u00e5terst\u00e4lla data fr\u00e5n moderna lagringsenheter. GPT:s st\u00f6d f\u00f6r st\u00f6rre diskar, flera partitioner och f\u00f6rb\u00e4ttrade dataintegritetsfunktioner, t.ex. redundans och CRC-skydd, s\u00e4kerst\u00e4ller att utredare kan komma \u00e5t och verifiera alla n\u00f6dv\u00e4ndiga data. GPT:s kompatibilitet med moderna operativsystem och UEFI-firmware f\u00f6rb\u00e4ttrar dessutom m\u00f6jligheten att utf\u00f6ra omfattande kriminaltekniska unders\u00f6kningar, vilket g\u00f6r den oumb\u00e4rlig f\u00f6r att avsl\u00f6ja digitala bevis och s\u00e4kerst\u00e4lla integriteten och tillf\u00f6rlitligheten hos kriminaltekniska resultat.&nbsp;<\/p>\n\n\n\n<p>Jag b\u00f6rjar med Protective MBR och hur den skiljer sig fr\u00e5n den traditionella MBR som anv\u00e4nds med \u00e4ldre enheter i BIOS. D\u00e4refter tar jag dig igenom GPT-huvudet och sedan GPT Entry Array. Slutligen delar jag med mig av n\u00e5gra avslutande tankar och tips om hur man f\u00f6rklarar dessa begrepp f\u00f6r en lekman, till exempel n\u00e4r man vittnar inf\u00f6r en domare eller jury.<\/p>\n\n\n\n<p>I slut\u00e4ndan, efter att ha l\u00e4st den h\u00e4r serien, kommer du inte att ha n\u00e5gra problem att ta itu med en CTF-utmaning som finns p\u00e5 v\u00e5r CTF-plattform.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"h-part-1\">DEL 1<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-the-protective-mbr\">Den skyddande MBR<\/h2>\n\n\n\n<p>Master Boot Record (MBR) fr\u00e5n en \u00e4ldre synvinkel gav oss en f\u00e4rdplan f\u00f6r att lokalisera upp till fyra prim\u00e4ra partitioner p\u00e5 en h\u00e5rddisk. Varje 16-byte partitionspost v\u00e4gledde oss till platsen f\u00f6r den partitionen, oavsett om det var FAT32 eller NTFS. Den gamla MBR hade dock begr\u00e4nsningar, inklusive men inte begr\u00e4nsat till:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>En storleksgr\u00e4ns p\u00e5 2 TB.<\/li>\n\n\n\n<li>Begr\u00e4nsad till 4 prim\u00e4ra partitioner; om fler beh\u00f6vs kan en av dessa prim\u00e4ra partitioner utses till en ut\u00f6kad partition.<\/li>\n\n\n\n<li>En enda felk\u00e4lla eftersom MBR, som inneh\u00e5ller partitionstabellen, var placerad i sektor 0 utan s\u00e4kerhetskopia.<\/li>\n<\/ul>\n\n\n\n<p>LBA 0 (logisk sektor 0) p\u00e5 en GPT-h\u00e5rddisk inneh\u00e5ller en s\u00e5 kallad Protective MBR i st\u00e4llet f\u00f6r en \u00e4ldre MBR. T\u00e4nk p\u00e5 Protective MBR som en skylt vid ing\u00e5ngen till biblioteket som s\u00e4ger till alla: \"Det h\u00e4r biblioteket anv\u00e4nder ett nytt och f\u00f6rb\u00e4ttrat system nu. Anv\u00e4nd inte den gamla metoden, f\u00f6r den fungerar inte h\u00e4r.\"<\/p>\n\n\n\n<p>I st\u00e4llet f\u00f6r att bara inneh\u00e5lla platsen f\u00f6r fyra prim\u00e4ra partitioner p\u00e5 enheten markerar Protective MBR hela disken som anv\u00e4nd av GPT, vilket indikerar f\u00f6r \u00e4ldre system att disken \u00e4r fullt utnyttjad. Protective MBR finns endast f\u00f6r bak\u00e5tkompatibilitet. Den inneh\u00e5ller ENDAST en partitionspost, vilket markerar disken och f\u00f6rhindrar att \u00e4ldre verktyg misstolkar diskstrukturen.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-structure-of-the-protective-mbr\">Struktur f\u00f6r den skyddande MBR<\/h3>\n\n\n\n<p>De f\u00f6rsta 440 byte i den skyddande MBR:en inneh\u00e5ller startkod som inte anv\u00e4nds av UEFI-system. Den ignoreras.&nbsp;&nbsp;<\/p>\n\n\n\n<p>Nedan visas en hypotetisk layout av en disk med en ny Windows 10-installation som bara har en partition skapad under installationsprocessen, C: -enheten. UEFI-systempartitionen skapas automatiskt och \u00e4r dold f\u00f6r anv\u00e4ndaren, och Microsoft Reserved Partition skapas ocks\u00e5 under installationen och \u00e4r dold f\u00f6r anv\u00e4ndaren.&nbsp;<\/p>\n\n\n\n<p>H\u00e4r kan vi se den skyddande MBR som finns p\u00e5 LBA 0, som pekar p\u00e5 GPT-huvudet p\u00e5 LBA 1.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img fetchpriority=\"high\" decoding=\"async\" width=\"740\" height=\"164\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1.png\" alt=\"\" class=\"wp-image-924\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1.png 740w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1-600x133.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Figure-1-300x66.png 300w\" sizes=\"(max-width: 740px) 100vw, 740px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-hex-layout-of-the-protective-mbr\">Hex-layout f\u00f6r den skyddande MBR:en<\/h3>\n\n\n\n<p>H\u00e4r \u00e4r ett exempel p\u00e5 en hex-layout f\u00f6r Protective MBR:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"751\" height=\"650\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1.png\" alt=\"\" class=\"wp-image-925\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1.png 751w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1-600x519.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD1-1-300x260.png 300w\" sizes=\"(max-width: 751px) 100vw, 751px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"749\" height=\"159\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1.png\" alt=\"\" class=\"wp-image-926\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1.png 749w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1-600x127.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-1-300x64.png 300w\" sizes=\"(max-width: 749px) 100vw, 749px\" \/><\/figure>\n\n\n\n<p>Som tidigare n\u00e4mnts anv\u00e4nds inte de f\u00f6rsta 440 byte av startkoden av UEFI-system. Du kan se dessa f\u00f6rsta 440 byte nollst\u00e4llda p\u00e5 vissa system. H\u00e4r \u00e4r Protective MBR fr\u00e5n den arbetsstation som jag anv\u00e4nder f\u00f6r att skriva den h\u00e4r bloggen, d\u00e4r jag anv\u00e4nder en Samsung 1TB NVME-enhet:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"811\" height=\"814\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2.png\" alt=\"\" class=\"wp-image-928\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2.png 811w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-300x300.png 300w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-100x100.png 100w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-600x602.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-150x150.png 150w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD2-768x771.png 768w\" sizes=\"(max-width: 811px) 100vw, 811px\" \/><\/figure>\n\n\n\n<p>Som du kan se inneh\u00e5ller hela Protective MBR i det h\u00e4r fallet nollor f\u00f6rutom de fyra byte som ligger vid offset 440 (som inte anv\u00e4nds), den f\u00f6rsta \"prim\u00e4ra partitionsposten\" (som bara pekar p\u00e5 LBA 1 - GPT-huvudet) och startsignaturen som ligger vid de tv\u00e5 sista byte i sektorn (0x55AA).&nbsp;<\/p>\n\n\n\n<p>L\u00e5t oss nu titta n\u00e4rmare p\u00e5 den enda partitionsposten som finns i en Protective MBR:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"748\" height=\"647\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3.png\" alt=\"\" class=\"wp-image-929\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3.png 748w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3-600x519.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD3-300x259.png 300w\" sizes=\"(max-width: 748px) 100vw, 748px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"752\" height=\"138\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2.png\" alt=\"\" class=\"wp-image-930\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2.png 752w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2-600x110.png 600w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-Table-2-300x55.png 300w\" sizes=\"(max-width: 752px) 100vw, 752px\" \/><\/figure>\n\n\n\n<p>Den f\u00f6rsta byten i partitionsposten s\u00e4tts till 0x00 f\u00f6r att ange att det inte \u00e4r en startbar partition. I en traditionell MBR skulle det h\u00e4r v\u00e4rdet antingen vara 0x00 (ej startbar) eller 0x80 (startbar). De f\u00f6ljande tre bytena representerar <strong>Start av CHS <\/strong>(Cylinder\/Huvud\/Sektor), vilket kommer att motsvara 4-byte-v\u00e4rdet i <strong>Start LBA<\/strong> f\u00e4ltet vid byteoffset 8. Startv\u00e4rdet f\u00f6r CHS kommer att s\u00e4ttas till <strong>0x000200<\/strong> som n\u00e4r den bryts ner och omvandlas till en LBA-adress \u00e4r 1.<\/p>\n\n\n\n<p>F\u00f6ljande en-byte-v\u00e4rde s\u00e4tts till <strong>0xEE<\/strong> f\u00f6r OS-typen: <strong>GPT Skyddande<\/strong>. V\u00e4rdet p\u00e5 tre byte i offset 5 s\u00e4tts till CHS-adressen f\u00f6r det sista logiska blocket p\u00e5 disken. Start-LBA:n, som tar oss till GPT-partitionshuvudet, finns i offset 8 i fyra byte och v\u00e4rdet kommer att s\u00e4ttas till <strong>0x01000000<\/strong> (eller LBA 1 vid l\u00e4sning med liten endian). De sista 4 byte i posten vid offset 12 representerar diskens storlek minus ett. Den \u00e4r inst\u00e4lld p\u00e5 <strong>0xFFFFFFFF<\/strong> om skivans storlek \u00e4r f\u00f6r stor f\u00f6r att kunna representeras i detta f\u00e4lt, vilket troligen \u00e4r fallet.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-repairing-a-protective-mrb\">Reparation av en skyddande MRB<\/h3>\n\n\n\n<p>Om MBR:n skadades, f\u00f6rlorades eller raderades kan du ers\u00e4tta sektor 0 genom att kopiera den skyddande MBR:n fr\u00e5n en annan enhet. Du kan ocks\u00e5 skapa en fr\u00e5n b\u00f6rjan genom att l\u00e4mna 0x00 fr\u00e5n offset 0 till 446 och sedan skapa en generisk partitionspost som pekar p\u00e5 LBA 1 och se till att 0xEE finns vid offset 4 f\u00f6r att ange OS-typen GPT Protective. Slutligen placerar du startsignaturen (0x55AA) p\u00e5 de tv\u00e5 sista byte i sektorn.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-generic-entry\"><em>Generiskt intr\u00e4de<\/em><\/h4>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>446<\/td><td>447<\/td><td>448<\/td><td>449<\/td><td>450<\/td><td>451<\/td><td>452<\/td><td>453<\/td><td>454<\/td><td>455<\/td><td>456<\/td><td>457<\/td><td>458<\/td><td>459<\/td><td>460<\/td><td>461<\/td><\/tr><tr><td>00<\/td><td>00<\/td><td>02<\/td><td>00<\/td><td>EE<\/td><td>FF<\/td><td>FF<\/td><td>FF<\/td><td>01<\/td><td>00<\/td><td>00<\/td><td>00<\/td><td>FF<\/td><td>FF<\/td><td>FF<\/td><td>FF<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-boot-signature\"><em>K\u00e4nga signatur<\/em><\/h4>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>510<\/td><td>511<\/td><\/tr><tr><td>55<\/td><td>AA<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>F\u00f6ljande skulle r\u00e4cka f\u00f6r en \u00e5teruppbyggd Protective MBR:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"508\" height=\"449\" src=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD4.png\" alt=\"\" class=\"wp-image-932\" srcset=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD4.png 508w, https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Blog1-HxD4-300x265.png 300w\" sizes=\"(max-width: 508px) 100vw, 508px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-conclusion\">Slutsats<\/h2>\n\n\n\n<p>I den h\u00e4r f\u00f6rsta delen utforskade vi Protective MBR och dess avg\u00f6rande roll f\u00f6r att s\u00e4kerst\u00e4lla bak\u00e5tkompatibilitet med \u00e4ldre system. Vi unders\u00f6kte hur Protective MBR markerar hela disken som anv\u00e4nd av GPT, vilket f\u00f6rhindrar \u00e4ldre system fr\u00e5n att misstolka diskens struktur. Genom att f\u00f6rst\u00e5 strukturen och funktionen hos Protective MBR har du nu en solid grund f\u00f6r att dyka djupare in i GPT-schemat.<\/p>\n\n\n\n<p>N\u00e4r vi g\u00e5r vidare kommer v\u00e5rt n\u00e4sta fokus att ligga p\u00e5 GPT Header, h\u00f6rnstenen i GPT-schemat som definierar disklayouten och s\u00e4kerst\u00e4ller dataintegritet. I del 2 kommer vi att bryta ner GPT-huvudet och unders\u00f6ka varje f\u00e4lt och dess betydelse. H\u00e5ll \u00f6gonen \u00f6ppna n\u00e4r vi forts\u00e4tter att reda ut komplexiteten i GPT-schemat, s\u00e5 att du f\u00e5r kunskapen att effektivt hantera och \u00e5terst\u00e4lla data fr\u00e5n moderna lagringsenheter.<\/p>\n\n\n\n<p><strong>Vill du dyka djupare in i GPT-strukturen?<br><\/strong><br>I <a class=\"\" href=\"https:\/\/elusivedata.io\/sv\/2-2\/\"><strong>Del 2<\/strong><\/a>bryter vi ner de <strong>GPT-huvud<\/strong> och f\u00f6rklara hur den s\u00e4kerst\u00e4ller dataintegritet \u00f6ver hela disken.<br>Sedan i <a class=\"\" href=\"https:\/\/elusivedata.io\/sv\/3-2\/\"><strong>Del 3<\/strong><\/a>utforskar vi de <strong>GPT Partition Entry Array<\/strong> och vad kriminaltekniker beh\u00f6ver veta n\u00e4r de rekonstruerar partitionstabeller.<\/p>","protected":false},"excerpt":{"rendered":"<p>Utforska den skyddande MBR:ns roll i GPT-partitionerade diskar. Den h\u00e4r guiden f\u00f6rdjupar sig i dess syfte, funktionalitet och betydelse i digitala kriminaltekniska utredningar.<\/p>","protected":false},"author":1,"featured_media":748,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"blog-post","footnotes":""},"categories":[19],"tags":[],"class_list":["post-918","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digital-forensics"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.3 (Yoast SEO v27.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Understanding the Protective MBR in GPT-Partitioned Disks. Part 1. - Elusive Data<\/title>\n<meta name=\"description\" content=\"Learn how the Protective MBR works in GPT-partitioned disks and why it matters in digital forensic investigations. Part 1 of our deep-dive series.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/sv\/1-2\/\" \/>\n<meta property=\"og:locale\" content=\"sv_SE\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Understanding the Protective MBR in GPT-Partitioned Disks.\" \/>\n<meta property=\"og:description\" content=\"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/sv\/1-2\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-22T16:04:21+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46-1024x675.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Understanding the Protective MBR in GPT-Partitioned Disks.\" \/>\n<meta name=\"twitter:description\" content=\"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png\" \/>\n<meta name=\"twitter:label1\" content=\"Skriven av\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Ber\u00e4knad l\u00e4stid\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minuter\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1.\",\"datePublished\":\"2024-11-22T16:04:21+00:00\",\"dateModified\":\"2025-07-18T18:04:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\"},\"wordCount\":1133,\"commentCount\":5,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"articleSection\":[\"Digital Forensics\"],\"inLanguage\":\"sv-SE\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\",\"name\":\"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1. - Elusive Data\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"datePublished\":\"2024-11-22T16:04:21+00:00\",\"dateModified\":\"2025-07-18T18:04:38+00:00\",\"description\":\"Learn how the Protective MBR works in GPT-partitioned disks and why it matters in digital forensic investigations. Part 1 of our deep-dive series.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#breadcrumb\"},\"inLanguage\":\"sv-SE\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"sv-SE\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Skarmavbild-2024-11-18-kl.-20.29.46.png\",\"width\":2662,\"height\":1754,\"caption\":\"Close-up of a hard disk drive, used to illustrate GPT disk structure in digital forensics.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/1-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"sv-SE\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"sv-SE\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"sv-SE\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/sv\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"F\u00f6rst\u00e5 den skyddande MBR i GPT-partitionerade diskar. Del 1. - Sv\u00e5rf\u00e5ngade data","description":"L\u00e4r dig hur Protective MBR fungerar i GPT-partitionerade diskar och varf\u00f6r det \u00e4r viktigt i digitala kriminaltekniska utredningar. Del 1 av v\u00e5r djupdykningsserie.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/sv\/1-2\/","og_locale":"sv_SE","og_type":"article","og_title":"Understanding the Protective MBR in GPT-Partitioned Disks.","og_description":"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.","og_url":"https:\/\/elusivedata.io\/sv\/1-2\/","og_site_name":"Elusive Data","article_published_time":"2024-11-22T16:04:21+00:00","article_modified_time":"2025-07-18T18:04:38+00:00","og_image":[{"width":1024,"height":675,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46-1024x675.png","type":"image\/png"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_title":"Understanding the Protective MBR in GPT-Partitioned Disks.","twitter_description":"Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.","twitter_image":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","twitter_misc":{"Skriven av":"James Eichbaum","Ber\u00e4knad l\u00e4stid":"7 minuter"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/1-2\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/1-2\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1.","datePublished":"2024-11-22T16:04:21+00:00","dateModified":"2025-07-18T18:04:38+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/1-2\/"},"wordCount":1133,"commentCount":5,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","articleSection":["Digital Forensics"],"inLanguage":"sv-SE","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/1-2\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/1-2\/","url":"https:\/\/elusivedata.io\/1-2\/","name":"F\u00f6rst\u00e5 den skyddande MBR i GPT-partitionerade diskar. Del 1. - Sv\u00e5rf\u00e5ngade data","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","datePublished":"2024-11-22T16:04:21+00:00","dateModified":"2025-07-18T18:04:38+00:00","description":"L\u00e4r dig hur Protective MBR fungerar i GPT-partitionerade diskar och varf\u00f6r det \u00e4r viktigt i digitala kriminaltekniska utredningar. Del 1 av v\u00e5r djupdykningsserie.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/1-2\/#breadcrumb"},"inLanguage":"sv-SE","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/1-2\/"]}]},{"@type":"ImageObject","inLanguage":"sv-SE","@id":"https:\/\/elusivedata.io\/1-2\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Skarmavbild-2024-11-18-kl.-20.29.46.png","width":2662,"height":1754,"caption":"Close-up of a hard disk drive, used to illustrate GPT disk structure in digital forensics."},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/1-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"Understanding the Protective MBR in GPT-Partitioned Disks. Part 1."}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"ElusiveData","description":"Utbildning och r\u00e5dgivning inom digital kriminalteknik","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"sv-SE"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"ElusiveData","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"sv-SE","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"sv-SE","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/sv\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/posts\/918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/comments?post=918"}],"version-history":[{"count":7,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/posts\/918\/revisions"}],"predecessor-version":[{"id":7450,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/posts\/918\/revisions\/7450"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/media\/748"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/media?parent=918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/categories?post=918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/tags?post=918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}