{"id":920,"date":"2024-11-22T16:06:10","date_gmt":"2024-11-22T16:06:10","guid":{"rendered":"https:\/\/elusivedata.io\/?p=920"},"modified":"2025-07-18T18:04:37","modified_gmt":"2025-07-18T18:04:37","slug":"2-2","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/sv\/2-2\/","title":{"rendered":"GPT del 2. GPT-huvudets roll i diskintegritet."},"content":{"rendered":"

Inledning<\/h2>\n\n\n\n

I den f\u00f6rsta delen av den h\u00e4r bloggserien utforskade vi Protective MBR och dess roll n\u00e4r det g\u00e4ller att s\u00e4kerst\u00e4lla att moderna GPT-partitionerade diskar \u00e4r kompatibla med \u00e4ldre system. Vi f\u00f6rdjupade oss i hur Protective MBR fungerar som en barri\u00e4r f\u00f6r att f\u00f6rhindra \u00e4ldre system fr\u00e5n att misstolka GPT-diskar och d\u00e4rigenom s\u00e4kerst\u00e4lla att hela disken markeras som anv\u00e4nd av GPT. Denna grundl\u00e4ggande f\u00f6rst\u00e5else skapar f\u00f6ruts\u00e4ttningar f\u00f6r en djupare dykning in i hj\u00e4rtat av GUID Partition Table (GPT) sj\u00e4lv - GPT Header.<\/p>\n\n\n\n

I den h\u00e4r andra delen g\u00e5r vi igenom GPT Header, en viktig komponent i GPT-schemat som ger viktig information om diskens struktur. Vi kommer att unders\u00f6ka varje f\u00e4lt i GPT-huvudet, f\u00f6rklara dess betydelse och hur det bidrar till diskens \u00f6vergripande funktionalitet och integritet. I slutet av detta inl\u00e4gg kommer du att ha en omfattande f\u00f6rst\u00e5else f\u00f6r GPT-huvudet, s\u00e5 att du med s\u00e4kerhet kan analysera och manipulera GPT-partitionerade diskar i kriminaltekniska utredningar eller data\u00e5terst\u00e4llningsscenarier.<\/p>\n\n\n\n

\u00d6versikt \u00f6ver GPT-huvuden<\/h2>\n\n\n\n

GPT-huvudet (GUID Partition Table) \u00e4r en viktig komponent i diskens partitioneringssystem. Den delar in disken i separata sektioner som var och en kan lagra olika typer av data, t.ex. operativsystem, personliga filer, programdata eller spel. Dessa sektioner kan vara olika enheter (t.ex. C:-enheten, D:-enheten, E:-enheten etc.).<\/p>\n\n\n\n

GPT Header inneh\u00e5ller en s\u00e4kerhetskopia i slutet av disken, ungef\u00e4r som att ha en reservnyckel till bibliotekskatalogen ifall huvudnyckeln f\u00f6rsvinner eller skadas. Detta s\u00e4kerst\u00e4ller att vi kan hitta och komma \u00e5t v\u00e5ra data \u00e4ven om n\u00e5got g\u00e5r fel.<\/p>\n\n\n\n

GPT-huvudet anger platsen f\u00f6r s\u00e4kerhetskopian och platsen f\u00f6r GUID Partition Table Entry Array, som \u00e4r en lista \u00f6ver GPT-partitionsposter som anger var dessa sektioner (partitioner) finns p\u00e5 disken.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Figur 1: Layout f\u00f6r en hypotetisk Windows 10-installation med en volym (n = sista sektorn p\u00e5 h\u00e5rddisken)<\/em><\/p>\n\n\n\n

GPT-huvudet b\u00f6rjar med sin signatur, EFI PART. Resten av v\u00e4rdena \u00e4r uppdelade i tabellen nedan:<\/p>\n\n\n\n

Struktur f\u00f6r GPT-huvuden<\/h2>\n\n\n\n

GPT Header b\u00f6rjar med sin signatur, \"EFI PART.\" Resten av v\u00e4rdena \u00e4r uppdelade i tabellen nedan:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
K\u00e4lla: https:\/\/uefi.org\/specs\/UEFI\/2.10\/05_GUID_Partition_Table_Format.html<\/a><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Hittills har de f\u00f6rsta 16 byte i GPT-headern f\u00f6rblivit konstanta mellan olika GPT-diskar.<\/p>\n\n\n\n
CRC f\u00f6r GPT-huvud<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Nedan f\u00f6ljer ett exempel p\u00e5 hur du ber\u00e4knar CRC32 f\u00f6r GPT-huvudet:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Du kan anv\u00e4nda ett Python-skript f\u00f6r att ber\u00e4kna CRC f\u00f6r isolerade byte:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Python-skriptet finns tillg\u00e4ngligt p\u00e5 https:\/\/github.com\/eichbaumj\/Python<\/a><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Python-skriptet tar det resulterande CRC32-v\u00e4rdet och konverterar det till det format som kr\u00e4vs f\u00f6r GPT-huvudet. Det ber\u00e4knade v\u00e4rdet \u00e4r i det h\u00e4r fallet 0x1B2C37BC. Men f\u00f6r att lagra det i f\u00e4ltet i GPT-huvudet l\u00e4ses v\u00e4rdet med liten endian: 0xBC372C1B. <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Diskens GUID<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
I sk\u00e4rmdumpen nedan visas GUID markerat i GPT-headern:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
GUID \u00e4r ett hexadecimalt v\u00e4rde p\u00e5 16 byte, men om du tror att du bara kan kopiera v\u00e4rdena och separera dem p\u00e5 l\u00e4mpligt s\u00e4tt med bindestreck och s\u00e4tta hakparenteser runt dem, s\u00e5 har du fel. Du skulle f\u00e5 fel v\u00e4rde.<\/p>\n\n\n\n
Du kan se att HxD tillhandah\u00e5ller GUID-konverteringen i datainspekt\u00f6ren till h\u00f6ger. Men hur g\u00e5r det till? Hur g\u00e5r det till:
55 BA 55 51 2B D8 59 41 BC 1F C4 17 80 0F D7 63<\/p>\n\n\n\n
Bli:<\/p>\n\n\n\n
{5155BA55-D82B-4159-BC1F-C417800FD763}<\/p>\n\n\n\n
GUID-format<\/em><\/h4>\n\n\n\n
XX XX XX XX | XX XX | XX XX | XX XX | XX XX | XX XX XX XX XX XX<\/p>\n\n\n\n
55 BA 55 51 | 2B D8 | 59 41 | BC 1F | C4 17 80 0F D7 63<\/p>\n\n\n\n
Den f\u00f6rsta upps\u00e4ttningen av fyra byte konverteras till little-endian hex: 51 55 BA 55<\/p>\n\n\n\n
Den andra upps\u00e4ttningen om 2 bytes konverteras till little-endian hex: D8 2B<\/p>\n\n\n\n
Den tredje upps\u00e4ttningen om 2 byte konverteras till little-endian hex: 59 41<\/p>\n\n\n\n
De \u00e5terst\u00e5ende tv\u00e5 upps\u00e4ttningarna av hex-v\u00e4rden l\u00e4mnas som de \u00e4r, big-endian: BC 1F | C4 17 80 0F D7 63<\/p>\n\n\n\n
N\u00e4r alla konverteringar \u00e4r klara kan vi s\u00e4tta ihop dem, placera bindestreck d\u00e4r de beh\u00f6ver vara och omsluta det med hakparenteser:<\/p>\n\n\n\n
{5155BA55-D82B-4159-BC1F-C417800FD763}<\/p>\n\n\n\n
Vi kan bekr\u00e4fta att detta \u00e4r den korrekta kodningen av GUID genom att starta diskpart fr\u00e5n kommandoraden och kontrollera diskens unika ID:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
GPT-partitionstabell Checksumma CRC<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Vi kan anv\u00e4nda samma Python-skript men ers\u00e4tta hex-v\u00e4rdena med de som finns i Partition Entry Array. <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Och vi kan se att v\u00e4rdet motsvarar det som finns i GPT-headern.<\/p>\n\n\n\n
Reparera en GPT-huvudenhet<\/h2>\n\n\n\n
Nu n\u00e4r vi vet hur GPT-headern \u00e4r uppbyggd och att det finns en s\u00e4kerhetskopia i diskens sista sektor, hur g\u00e5r vi d\u00e5 tillv\u00e4ga f\u00f6r att reparera GPT-headern om den skulle bli skadad eller raderad?<\/p>\n\n\n\n
F\u00f6r att reparera GPT-huvudet kopierar du de sista 512 byte fr\u00e5n slutet av disken och klistrar in dem i LBA 1 (sektor #2). Observera att n\u00e5gra modifieringar \u00e4r n\u00f6dv\u00e4ndiga.<\/p>\n\n\n\n
Nedan visas ett exempel p\u00e5 hur GPT-headern f\u00f6r s\u00e4kerhetskopiering ser ut i slutet av en disk:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Vi kan se att vissa v\u00e4rden f\u00f6rblir konstanta j\u00e4mf\u00f6rt med den ursprungliga GPT-headern. Dessa konstanter \u00e4r markerade med r\u00f6tt nedan:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Det finns fyra v\u00e4rden som beh\u00f6ver \u00e4ndras.<\/p>\n\n\n\n
Den f\u00f6rsta \u00e4r GPT Header CRC, som vi kommer att \u00e5terkomma till. F\u00f6r tillf\u00e4llet kan dessa v\u00e4rden nollst\u00e4llas eftersom vi m\u00e5ste anv\u00e4nda den CRC som ber\u00e4knas efter att vi har modifierat de andra v\u00e4rdena f\u00f6r att f\u00e5 r\u00e4tt CRC igen.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
N\u00e4sta \u00e4r MyLBA-v\u00e4rdet som ligger vid offset 24 i 4 byte. Det h\u00e4r v\u00e4rdet pekar p\u00e5 platsen f\u00f6r GPT-huvudet (d\u00e4r det finns f\u00f6r n\u00e4rvarande) och dess nuvarande position \u00e4r LBA 1 eller 0x01000000000000000. <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
V\u00e4rdet p\u00e5 8 byte vid offset 32 \u00e4r det v\u00e4rde som pekar oss till platsen f\u00f6r GPT-headern f\u00f6r s\u00e4kerhetskopian. S\u00e4kerhetskopian pekar f\u00f6r n\u00e4rvarande p\u00e5 originalet, men vi m\u00e5ste \u00e4ndra detta v\u00e4rde f\u00f6r att representera den sista sektorn p\u00e5 disken. Detta h\u00e4nde med de hexadecimala v\u00e4rden som vi just \u00e4ndrade i f\u00f6reg\u00e5ende steg. I det h\u00e4r exemplet skulle v\u00e4rdet beh\u00f6va \u00e4ndras till 0xAFD23B7700000000.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Det 8-byte-v\u00e4rde som finns i offset 72 m\u00e5ste \u00e5terspegla platsen f\u00f6r och starten p\u00e5 GPT Partition Entry Array. F\u00f6r n\u00e4rvarande pekar GPT-huvudet f\u00f6r s\u00e4kerhetskopiering p\u00e5 s\u00e4kerhetskopieringen av den matrisen. Den faktiska GPT-partitioneringsmatrisen b\u00f6r finnas p\u00e5 LBA 2. Detta v\u00e4rde m\u00e5ste \u00e4ndras till 0x0200000000000000.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
N\u00e4r dessa tre v\u00e4rden har \u00e4ndrats \u00e4r det dags att ber\u00e4kna CRC32-v\u00e4rdet. <\/p>\n\n\n\n
Den resulterande kontrollsumman \u00e4r:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
S\u00e5 nu kan vi ers\u00e4tta 0x00000000-v\u00e4rdena vid offset 16 med 0xBC372C1B:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
HxD har en CRC32-kontrollsummaber\u00e4knare inbyggd under Analys -> Kontrollsummor. Det resulterande v\u00e4rdet beh\u00f6ver bara l\u00e4ggas till som ett little-endian-v\u00e4rde.<\/p>\n\n\n\n
Om vi av ren nyfikenhet skulle isolera dessa 512 byte f\u00f6r originalet och s\u00e4kerhetskopian som vi \u00e5terst\u00e4llde, matchar hashv\u00e4rdena verkligen, vilket indikerar att vi framg\u00e5ngsrikt reproducerade den ursprungliga GPT Header med hj\u00e4lp av s\u00e4kerhetskopian.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Slutsats<\/h2>\n\n\n\n
Att f\u00f6rst\u00e5 hur GPT-headern fungerar \u00e4r viktigt f\u00f6r alla som arbetar med digital kriminalteknik, data\u00e5terst\u00e4llning eller systemadministration. GPT-huvudet definierar inte bara diskens layout och struktur utan s\u00e4kerst\u00e4ller \u00e4ven dataintegritet genom mekanismer som CRC32-kontrollsummor och s\u00e4kerhetskopieringshuvuden. Genom att beh\u00e4rska detaljerna i GPT-huvudet \u00e4r du b\u00e4ttre rustad att fels\u00f6ka och reparera diskproblem, vilket s\u00e4kerst\u00e4ller tillf\u00f6rlitligheten och tillg\u00e4ngligheten f\u00f6r kritiska data.<\/p>\n\n\n\n
N\u00e4r vi forts\u00e4tter den h\u00e4r serien kommer v\u00e5rt n\u00e4sta fokus att vara p\u00e5 GPT Partition Table Entry Array. Vi kommer att utforska hur partitionsposter \u00e4r strukturerade och hur de arbetar tillsammans med GPT Header f\u00f6r att uppr\u00e4tth\u00e5lla organisationen och integriteten hos diskpartitioner. H\u00e5ll \u00f6gonen \u00f6ppna f\u00f6r en omfattande guide om att analysera och reparera GPT Partition Table Entry Array, vilket ger dig ytterligare kunskap att hantera GPT-partitionerade diskar med sj\u00e4lvf\u00f6rtroende.<\/p>\n\n\n\n
Missade du del 1?<\/strong><\/p>\n\n\n\n
B\u00f6rja fr\u00e5n b\u00f6rjan: F\u00f6rst\u00e5 den skyddande MBR:en p\u00e5 GPT-partitionerade diskar (del 1)<\/a> - d\u00e4r vi g\u00e5r igenom hur GPT s\u00e4kerst\u00e4ller bak\u00e5tkompatibilitet med \u00e4ldre system.<\/p>\n\n\n\n
\u00c4r du redo f\u00f6r n\u00e4sta steg?<\/strong><\/p>\n\n\n\n
Forts\u00e4tt till Del 3: Navigera i GPT-partitionens inmatningsf\u00e4lt<\/a> - d\u00e4r vi unders\u00f6ker hur partitionsposter \u00e4r strukturerade och hur de kompletterar GPT Header.<\/p>","protected":false},"excerpt":{"rendered":"
Utforska GPT-headerns viktiga roll f\u00f6r att uppr\u00e4tth\u00e5lla diskintegriteten. Den h\u00e4r artikeln ger insikter om dess struktur, syfte och relevans i kriminaltekniska utredningar.<\/p>","protected":false},"author":1,"featured_media":579,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[19],"tags":[],"class_list":["post-920","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digital-forensics"],"acf":[],"yoast_head":"\nGPT part 2. The Role of the GPT Header in Disk Integrity. - Elusive Data<\/title>\n<meta name=\"description\" content=\"Explore the role of the GPT Header in maintaining disk integrity and enabling forensic analysis. Part 2 of our series on GUID Partition Table structures for digital investigators.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/sv\/2-2\/\" \/>\n<meta property=\"og:locale\" content=\"sv_SE\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GPT part 2. The Role of the GPT Header in Disk Integrity.\" \/>\n<meta property=\"og:description\" content=\"Explore the role of the GPT Header in maintaining disk integrity and enabling forensic analysis. Part 2 of our series on GUID Partition Table structures for digital investigators.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/sv\/2-2\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-22T16:06:10+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:37+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD2-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1920\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Skriven av\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Ber\u00e4knad l\u00e4stid\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minuter\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"GPT part 2. The Role of the GPT Header in Disk Integrity.\",\"datePublished\":\"2024-11-22T16:06:10+00:00\",\"dateModified\":\"2025-07-18T18:04:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/\"},\"wordCount\":1382,\"commentCount\":2,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD2-scaled.jpg\",\"articleSection\":[\"Digital Forensics\"],\"inLanguage\":\"sv-SE\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/\",\"name\":\"GPT part 2. The Role of the GPT Header in Disk Integrity. - Elusive Data\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD2-scaled.jpg\",\"datePublished\":\"2024-11-22T16:06:10+00:00\",\"dateModified\":\"2025-07-18T18:04:37+00:00\",\"description\":\"Explore the role of the GPT Header in maintaining disk integrity and enabling forensic analysis. Part 2 of our series on GUID Partition Table structures for digital investigators.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/#breadcrumb\"},\"inLanguage\":\"sv-SE\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"sv-SE\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD2-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD2-scaled.jpg\",\"width\":2560,\"height\":1920,\"caption\":\"Hard disk drive \u2014 digital forensics evidence storage device analysis\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/2-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GPT part 2. The Role of the GPT Header in Disk Integrity.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"sv-SE\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"sv-SE\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"sv-SE\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/sv\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"GPT del 2. GPT-huvudets roll i diskintegritet. - Sv\u00e5rf\u00e5ngade data","description":"Explore the role of the GPT Header in maintaining disk integrity and enabling forensic analysis. Part 2 of our series on GUID Partition Table structures for digital investigators.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/sv\/2-2\/","og_locale":"sv_SE","og_type":"article","og_title":"GPT part 2. The Role of the GPT Header in Disk Integrity.","og_description":"Explore the role of the GPT Header in maintaining disk integrity and enabling forensic analysis. Part 2 of our series on GUID Partition Table structures for digital investigators.","og_url":"https:\/\/elusivedata.io\/sv\/2-2\/","og_site_name":"Elusive Data","article_published_time":"2024-11-22T16:06:10+00:00","article_modified_time":"2025-07-18T18:04:37+00:00","og_image":[{"width":2560,"height":1920,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD2-scaled.jpg","type":"image\/jpeg"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_misc":{"Skriven av":"James Eichbaum","Ber\u00e4knad l\u00e4stid":"12 minuter"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/2-2\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/2-2\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"GPT part 2. The Role of the GPT Header in Disk Integrity.","datePublished":"2024-11-22T16:06:10+00:00","dateModified":"2025-07-18T18:04:37+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/2-2\/"},"wordCount":1382,"commentCount":2,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/2-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD2-scaled.jpg","articleSection":["Digital Forensics"],"inLanguage":"sv-SE","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/2-2\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/2-2\/","url":"https:\/\/elusivedata.io\/2-2\/","name":"GPT del 2. GPT-huvudets roll i diskintegritet. - Sv\u00e5rf\u00e5ngade data","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/2-2\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/2-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD2-scaled.jpg","datePublished":"2024-11-22T16:06:10+00:00","dateModified":"2025-07-18T18:04:37+00:00","description":"Explore the role of the GPT Header in maintaining disk integrity and enabling forensic analysis. Part 2 of our series on GUID Partition Table structures for digital investigators.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/2-2\/#breadcrumb"},"inLanguage":"sv-SE","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/2-2\/"]}]},{"@type":"ImageObject","inLanguage":"sv-SE","@id":"https:\/\/elusivedata.io\/2-2\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD2-scaled.jpg","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD2-scaled.jpg","width":2560,"height":1920,"caption":"Hard disk drive \u2014 digital forensics evidence storage device analysis"},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/2-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"GPT part 2. The Role of the GPT Header in Disk Integrity."}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"ElusiveData","description":"Utbildning och r\u00e5dgivning inom digital kriminalteknik","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"sv-SE"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"ElusiveData","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"sv-SE","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"sv-SE","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/sv\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/posts\/920","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/comments?post=920"}],"version-history":[{"count":11,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/posts\/920\/revisions"}],"predecessor-version":[{"id":7452,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/posts\/920\/revisions\/7452"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/media\/579"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/media?parent=920"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/categories?post=920"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/tags?post=920"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}