{"id":922,"date":"2024-11-22T16:07:40","date_gmt":"2024-11-22T16:07:40","guid":{"rendered":"https:\/\/elusivedata.io\/?p=922"},"modified":"2025-07-18T18:04:35","modified_gmt":"2025-07-18T18:04:35","slug":"3-2","status":"publish","type":"post","link":"https:\/\/elusivedata.io\/sv\/3-2\/","title":{"rendered":"Navigera i GPT-partitionens inmatningsf\u00e4lt f\u00f6r r\u00e4ttsmedicinsk analys. Del 3."},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>\n

Del 3<\/h1>\n

<\/p>\n

Inledning<\/h2>\n

<\/p>\n

I v\u00e5ra tidigare inl\u00e4gg lade vi grunden f\u00f6r att f\u00f6rst\u00e5 GUID-partitionstabellen (GPT) genom att unders\u00f6ka den skyddande MBR:en och GPT-huvudet. Nu, i del 3, v\u00e4nder vi v\u00e5rt fokus till GPT Partition Entry Array. Denna viktiga komponent i GPT-schemat ger en detaljerad karta \u00f6ver alla partitioner p\u00e5 disken, d\u00e4r varje post inneh\u00e5ller viktig information om en specifik partition. Genom att f\u00f6rst\u00e5 strukturen och funktionen hos GPT Partition Entry Array f\u00e5r du en helt\u00e4ckande bild av hur GPT hanterar partitioner, vilket m\u00f6jligg\u00f6r effektivare analys, fels\u00f6kning och data\u00e5terst\u00e4llning.<\/p>\n

<\/p>\n

GPT (GUID-partitionstabell) Partition Entry Array<\/h2>\n

<\/p>\n

GUID Partition Table (GPT) Entry Array \u00e4r en viktig del av GPT-partitioneringssystemet, som anv\u00e4nds f\u00f6r att definiera och hantera partitionerna p\u00e5 en h\u00e5rddisk. T\u00e4nk p\u00e5 det som en detaljerad lista som inneh\u00e5ller uppgifter om varje partition p\u00e5 h\u00e5rddisken, ungef\u00e4r som en bibliotekskatalog som inneh\u00e5ller uppgifter om varje bok.<\/p>\n

<\/p>\n

Nyckelkomponenter i GPT Entry Array:<\/h3>\n

<\/p>\n

Partition GUID<\/strong>: Varje partition har en unik identifierare, Partition GUID, som s\u00e4kerst\u00e4ller att varje partition kan identifieras p\u00e5 ett unikt s\u00e4tt, \u00e4ven i olika system.<\/p>\n

<\/p>\n

Unikt ID<\/strong>: Detta \u00e4r en annan unik identifierare som \u00e4r specifik f\u00f6r varje partition, vilket ger ytterligare ett lager av unik identifiering.<\/p>\n

<\/p>\n

Starta LBA (logisk blockadressering) f\u00f6r partitionen<\/strong>: H\u00e4r anges partitionens startpunkt p\u00e5 h\u00e5rddisken. Det talar om f\u00f6r systemet var partitionen b\u00f6rjar.<\/p>\n

<\/p>\n

LBA f\u00f6r partitionens slut<\/strong>: Precis som start-LBA anger detta var partitionen slutar p\u00e5 disken.<\/p>\n

<\/p>\n

Attribut Bits<\/strong>: Det h\u00e4r \u00e4r flaggor som ger ytterligare information om partitionen, t.ex. om den \u00e4r startbar eller om den har n\u00e5gra speciella attribut.<\/p>\n

<\/p>\n

Partitionens namn<\/strong>: Varje partition kan ha ett namn som kan l\u00e4sas av m\u00e4nniskor, vilket g\u00f6r det l\u00e4ttare f\u00f6r oss att identifiera partitionens syfte eller inneh\u00e5ll. Namnet avslutas med ett null-tecken f\u00f6r att markera slutet p\u00e5 str\u00e4ngen.<\/p>\n

<\/p>\n

L\u00e5t oss bryta ner alla dessa i detalj s\u00e5 att du f\u00f6rst\u00e5r varje post i matrisen.<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

N\u00e4r disken \u00e4r konfigurerad som en GPT-disk \u00e4r den f\u00f6rsta partitionen som skapas EFI System Partition (ESP). Detta \u00e4r en dold partition som inte \u00e4r l\u00e4tt tillg\u00e4nglig f\u00f6r anv\u00e4ndarna. Den h\u00e4r partitionen finns i sektor 2048 och \u00e4r formaterad som FAT32 f\u00f6r kompatibilitet med alla system (Windows, Linux, MacOS).<\/p>\n

<\/p>\n

Sk\u00e4rmdumpen ovan visar en standardinstallation av Windows 10 d\u00e4r Microsoft Reserved Partition skapades tillsammans med en Basic Data Partition som specificerades av anv\u00e4ndaren under installationen.<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Nedan f\u00f6ljer ett utdrag av GUIDs fr\u00e5n en tabell som finns p\u00e5 Wikipedia-sidan GUID Partition Table:<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

K\u00e4lla: https:\/\/en.wikipedia.org\/wiki\/GUID_Partition_Table#Partition_type_GUIDs<\/a><\/p>\n

<\/p>\n

Naturligtvis kommer GUID inte att lagras i GUIID-formul\u00e4ret n\u00e4r du visar v\u00e4rdena i Hex Viewer.\u00a0<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

GUID:erna konverteras precis som vi gjorde i det tidigare blogginl\u00e4gget, men kan ocks\u00e5 enkelt ses n\u00e4r man tittar p\u00e5 det i HxD:<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Vi kan bekr\u00e4fta GUID:erna f\u00f6r volympartitionerna med kommandot: mountvol.exe<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Genom att k\u00e4nna till start-LBA och slut-LBA kan vi ber\u00e4kna hur stor partitionen \u00e4r. Till exempel EFI-partitionen:<\/p>\n

<\/p>\n

Startande LBA: 2048<\/p>\n

<\/p>\n

Slutande LBA: 534527<\/p>\n

<\/p>\n

Total l\u00e4ngd: 532479 sektorer x 512 byte\/sektor = 272629248 byte vilket \u00e4r 260 MB.<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

GPT-partitionens inmatningsmatris f\u00f6r s\u00e4kerhetskopiering<\/h2>\n

<\/p>\n

Backup GPT Partition Entry Array \u00e4r placerad i slutet av disken och f\u00f6re GPT Header, n\u00e4rmare best\u00e4mt 33 sektorer f\u00f6re slutet av disken (LBA (n - 33) d\u00e4r n \u00e4r den sista sektorn p\u00e5 disken). Vi kan ocks\u00e5 g\u00f6ra en ber\u00e4kning av varf\u00f6r det \u00e4r 33 sektorer f\u00f6re slutet av disken eller 32 sektorer f\u00f6re GPT-huvudet f\u00f6r s\u00e4kerhetskopiering.<\/p>\n

<\/p>\n

Varje partitionspost \u00e4r 128 byte och det finns totalt 128 poster i Entry Array. Det inneb\u00e4r att det finns 16 384 sektorer i matrisen eller 32 sektorer (16384\/512).\u00a0<\/p>\n

<\/p>\n

Backup GPT Header pekar p\u00e5 platsen f\u00f6r Backup GPT Partition Entry Array<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Backup GPT Partition Entry Array n\u00e4ra slutet av disken<\/p>\n

<\/p>\n

Reparera en GPT-partition Entry Array<\/h2>\n

<\/p>\n

Att reparera GPT Partition Entry Array \u00e4r lika enkelt som att kopiera den 16.384 byte stora s\u00e4kerhetskopian som hittades i 33 sektorer fr\u00e5n slutet av disken och klistra in dem i LBA 2 till 3. Det finns inget behov av n\u00e5gra \u00e4ndringar\/modifieringar av hex-v\u00e4rden eftersom dessa \u00e4r exakta kopior.<\/p>\n

<\/p>\n

Backup-GPT:en som ligger n\u00e4ra slutet av disken \u00e4r densamma som den prim\u00e4ra. Faktum \u00e4r att om man sk\u00e4r ut sektorerna f\u00f6r var och en och hashar dem visar det att de \u00e4r en exakt matchning.\u00a0<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

Slutsats<\/h2>\n

<\/p>\n

I den h\u00e4r tredje delen har vi grundligt unders\u00f6kt GPT Partition Entry Array, en kritisk komponent i GPT-schemat. Genom att bryta ned varje f\u00e4lt i partitionsposterna, fr\u00e5n GUID:erna till attributbitarna och partitionsnamnen, har vi sett hur GPT ger ett robust ramverk f\u00f6r att organisera och komma \u00e5t diskdata. Den h\u00e4r kunskapen \u00e4r viktig f\u00f6r kriminaltekniska unders\u00f6kningar, data\u00e5terst\u00e4llning och systemadministration, och ger dig f\u00e4rdigheter att navigera och manipulera GPT-partitionerade diskar p\u00e5 ett effektivt s\u00e4tt. H\u00e5ll \u00f6gonen \u00f6ppna f\u00f6r v\u00e5rt n\u00e4sta inl\u00e4gg, d\u00e4r vi kommer att f\u00f6rdjupa oss i praktiska till\u00e4mpningar och fallstudier och oms\u00e4tta teori i praktik.<\/p>\n

Detta inl\u00e4gg avslutar v\u00e5r 3-delade serie om GPT-partitionsstrukturer.<\/strong>
Om du missat de tidigare inl\u00e4ggen kan du b\u00f6rja med Del 1 - Den skyddande MBR:en<\/strong><\/a>d\u00e4r vi unders\u00f6ker hur kompatibilitet med \u00e4ldre system uppr\u00e4tth\u00e5lls, och forts\u00e4tter med Del 2 - GPT-huvudet<\/strong><\/a>, som definierar disklayouten och s\u00e4kerst\u00e4ller integriteten.<\/p>\n

Vill du g\u00e5 djupare? Prenumerera p\u00e5 v\u00e5rt nyhetsbrev f\u00f6r kommande inneh\u00e5ll om partitions\u00e5terst\u00e4llning, hashing p\u00e5 diskniv\u00e5 och CTF-utmaningar baserade p\u00e5 verkliga kriminaltekniska scenarier.<\/p>\n

<\/p>\n

<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

F\u00e5 en djupare f\u00f6rst\u00e5else f\u00f6r GPT Partition Entry Array och dess betydelse i digital kriminalteknisk analys. Den h\u00e4r guiden utforskar viktiga tekniker och insikter f\u00f6r att f\u00f6rb\u00e4ttra dina kriminaltekniska utredningar.<\/p>","protected":false},"author":1,"featured_media":580,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[19],"tags":[],"class_list":["post-922","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digital-forensics"],"acf":[],"yoast_head":"\nNavigating the GPT Partition Entry Array for Forensic Analysis. Part 3. - Elusive Data<\/title>\n<meta name=\"description\" content=\"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/elusivedata.io\/sv\/3-2\/\" \/>\n<meta property=\"og:locale\" content=\"sv_SE\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.\" \/>\n<meta property=\"og:description\" content=\"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/elusivedata.io\/sv\/3-2\/\" \/>\n<meta property=\"og:site_name\" content=\"Elusive Data\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-22T16:07:40+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-18T18:04:35+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1707\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"James Eichbaum\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Skriven av\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Eichbaum\" \/>\n\t<meta name=\"twitter:label2\" content=\"Ber\u00e4knad l\u00e4stid\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minuter\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\"},\"author\":{\"name\":\"James Eichbaum\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\"},\"headline\":\"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.\",\"datePublished\":\"2024-11-22T16:07:40+00:00\",\"dateModified\":\"2025-07-18T18:04:35+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\"},\"wordCount\":919,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD3-1-scaled.jpg\",\"articleSection\":[\"Digital Forensics\"],\"inLanguage\":\"sv-SE\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\",\"name\":\"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3. - Elusive Data\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD3-1-scaled.jpg\",\"datePublished\":\"2024-11-22T16:07:40+00:00\",\"dateModified\":\"2025-07-18T18:04:35+00:00\",\"description\":\"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#breadcrumb\"},\"inLanguage\":\"sv-SE\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"sv-SE\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD3-1-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/HDD3-1-scaled.jpg\",\"width\":2560,\"height\":1707,\"caption\":\"Hard disk drive \u2014 digital forensics evidence storage device analysis\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/3-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/elusivedata.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#website\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"name\":\"ElusiveData\",\"description\":\"Excellence in Digital Forensics Training and Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/elusivedata.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"sv-SE\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#organization\",\"name\":\"ElusiveData\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"sv-SE\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Asset-3_2x-scaled.png\",\"width\":2560,\"height\":370,\"caption\":\"ElusiveData\"},\"image\":{\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@elusivedata\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/#\\\/schema\\\/person\\\/2c00b8313d6aef321fd69bf82e2aa436\",\"name\":\"James Eichbaum\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"sv-SE\",\"@id\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"url\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"contentUrl\":\"https:\\\/\\\/elusivedata.io\\\/wp-content\\\/plugins\\\/ld-dashboard\\\/public\\\/img\\\/img_avatar.png\",\"caption\":\"James Eichbaum\"},\"sameAs\":[\"http:\\\/\\\/elusivedata.io\"],\"url\":\"https:\\\/\\\/elusivedata.io\\\/sv\\\/author\\\/eichbaumjamesgmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Navigera i GPT-partitionens inmatningsf\u00e4lt f\u00f6r r\u00e4ttsmedicinsk analys. Del 3. - Sv\u00e5rf\u00e5ngade data","description":"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/elusivedata.io\/sv\/3-2\/","og_locale":"sv_SE","og_type":"article","og_title":"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.","og_description":"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.","og_url":"https:\/\/elusivedata.io\/sv\/3-2\/","og_site_name":"Elusive Data","article_published_time":"2024-11-22T16:07:40+00:00","article_modified_time":"2025-07-18T18:04:35+00:00","og_image":[{"width":2560,"height":1707,"url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","type":"image\/jpeg"}],"author":"James Eichbaum","twitter_card":"summary_large_image","twitter_misc":{"Skriven av":"James Eichbaum","Ber\u00e4knad l\u00e4stid":"7 minuter"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/elusivedata.io\/3-2\/#article","isPartOf":{"@id":"https:\/\/elusivedata.io\/3-2\/"},"author":{"name":"James Eichbaum","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436"},"headline":"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3.","datePublished":"2024-11-22T16:07:40+00:00","dateModified":"2025-07-18T18:04:35+00:00","mainEntityOfPage":{"@id":"https:\/\/elusivedata.io\/3-2\/"},"wordCount":919,"commentCount":1,"publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"image":{"@id":"https:\/\/elusivedata.io\/3-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","articleSection":["Digital Forensics"],"inLanguage":"sv-SE","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/elusivedata.io\/3-2\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/elusivedata.io\/3-2\/","url":"https:\/\/elusivedata.io\/3-2\/","name":"Navigera i GPT-partitionens inmatningsf\u00e4lt f\u00f6r r\u00e4ttsmedicinsk analys. Del 3. - Sv\u00e5rf\u00e5ngade data","isPartOf":{"@id":"https:\/\/elusivedata.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/elusivedata.io\/3-2\/#primaryimage"},"image":{"@id":"https:\/\/elusivedata.io\/3-2\/#primaryimage"},"thumbnailUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","datePublished":"2024-11-22T16:07:40+00:00","dateModified":"2025-07-18T18:04:35+00:00","description":"Learn how to navigate the GPT Partition Entry Array during forensic disk analysis. Understanding partition structures helps investigators locate and recover disk-level evidence.","breadcrumb":{"@id":"https:\/\/elusivedata.io\/3-2\/#breadcrumb"},"inLanguage":"sv-SE","potentialAction":[{"@type":"ReadAction","target":["https:\/\/elusivedata.io\/3-2\/"]}]},{"@type":"ImageObject","inLanguage":"sv-SE","@id":"https:\/\/elusivedata.io\/3-2\/#primaryimage","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/HDD3-1-scaled.jpg","width":2560,"height":1707,"caption":"Hard disk drive \u2014 digital forensics evidence storage device analysis"},{"@type":"BreadcrumbList","@id":"https:\/\/elusivedata.io\/3-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/elusivedata.io\/"},{"@type":"ListItem","position":2,"name":"Navigating the GPT Partition Entry Array for Forensic Analysis. Part 3."}]},{"@type":"WebSite","@id":"https:\/\/elusivedata.io\/#website","url":"https:\/\/elusivedata.io\/","name":"ElusiveData","description":"Utbildning och r\u00e5dgivning inom digital kriminalteknik","publisher":{"@id":"https:\/\/elusivedata.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/elusivedata.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"sv-SE"},{"@type":"Organization","@id":"https:\/\/elusivedata.io\/#organization","name":"ElusiveData","url":"https:\/\/elusivedata.io\/","logo":{"@type":"ImageObject","inLanguage":"sv-SE","@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/","url":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/uploads\/2024\/11\/Asset-3_2x-scaled.png","width":2560,"height":370,"caption":"ElusiveData"},"image":{"@id":"https:\/\/elusivedata.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@elusivedata"]},{"@type":"Person","@id":"https:\/\/elusivedata.io\/#\/schema\/person\/2c00b8313d6aef321fd69bf82e2aa436","name":"James Eichbaum","image":{"@type":"ImageObject","inLanguage":"sv-SE","@id":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","url":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","contentUrl":"https:\/\/elusivedata.io\/wp-content\/plugins\/ld-dashboard\/public\/img\/img_avatar.png","caption":"James Eichbaum"},"sameAs":["http:\/\/elusivedata.io"],"url":"https:\/\/elusivedata.io\/sv\/author\/eichbaumjamesgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/posts\/922","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/comments?post=922"}],"version-history":[{"count":9,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/posts\/922\/revisions"}],"predecessor-version":[{"id":7455,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/posts\/922\/revisions\/7455"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/media\/580"}],"wp:attachment":[{"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/media?parent=922"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/categories?post=922"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/elusivedata.io\/sv\/wp-json\/wp\/v2\/tags?post=922"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}