- •The project has been funded by the European Commission. The Education, Audiovisual and
- •Partitions and other file system artifacts
- •Partitions
- •BIOS
- •Operating system boot structure (BIOS-MBR)
- •Partition Styles
- •BIOS-MBR
- •Partition Styles
- •Bootcode
- •Partition Styles
- •Master Boot Record
- •Master Boot Record
- •Master Boot Record
- •Master Boot Record Hands On
- •CHS Addressing
- •Master Boot Record Hands On
- •extended boot records
- •In the first sector of the extended section is the EBR structure (Extended
- •GPT-Style
- •In its partition table, a single entry must be created with partition type
- •Extensible Firmware Interface
- •GPT Overview
- •GPT allows you to assign a unique 128-bit identifier (GUID) to partitions
- •Reading the GUID
- •GUID Partition Table Format
- •GUID Partition Table Format
- •GUID Partition Table Structure
- •Primary GPT Header
- •Primary GPT Header
- •Partition Entry
- •Partition entries are done simple and are done with equally incremented addresses. The
- •Active partition
- •NTFS VBR
- •NTFS VBR
- •NTFS VBR
- •NTFS VBR
- •NTFS VBR
- •NTFS VBR and some GPT notes
The project has been funded by the European Commission. The Education, Audiovisual and Culture Executive program (EACEA), TEMPUS IV. The content of this presentation reflects the opinion of the author.
Partitions. MBR. GPT.
Developers:
J. Rolnik
T. Willkomm
A. Kühn
A.Snihurov
Partitions and other file system artifacts
•Partitions
•Partition Styles
•MBR Style
•GPT Style
•MBR
•Master Boot Code
•Master Partition Table
•GPT
•Overview
•GUIDs
•GUID Partition Table Format
02/02/2021 |
ISEC 2010 – Cybercrime Investigation Training |
2 |
Partitions
•A computer cannot address a physical hard drive until it’s been partitioned (or initialized) and the MBR written to disk, with at least one partition identified
•Partitions are contiguous areas of the drive reserved for Logical Drives
•Partitions may be defined in the MBR Partition Table or within a GPT Partition Entry
02/02/2021 |
ISEC 2010 – Cybercrime Investigation Training |
3 |
BIOS
Basic Input-Output system
UEFI
Unified Extensible
Firmware Interface
UEFI support in the Windows operating system appeared with the release of Windows Vista Service Pack 1 and Windows 7
BIOS-MBR
MBR
Initial Program Load (IPL1)
active partition
(VBR)
Volume Boot Record
Initial Program Load (IPL2)
(80h flag)
UEFI-GPT
GPT
GUID Partition Table
EFI
Extensible Firmware
Interface
FAT-32
hidden
boot process
operating system
Bootmgr
operating system
Bootmgr
4
Operating system boot structure (BIOS-MBR)
5
Partition Styles
Partition Style refers to the method that the operating system organizes partitions on a disk
MBR
̶4 Primary or 3 Primary and 1 Extended
̶Extended Partition can be divided into 1 or more logical volumes
GPT
̶Up to 128 Partitions
Other Types of Partition Styles
̶Apple Partition Map
̶?
02/02/2021 |
ISEC 2010 – Cybercrime Investigation Training |
6 |
BIOS-MBR
Download only from hard drives of not more than 2.1 TB.
UEFI-GPT
1. UEFI firmware can boot from disks larger than 2.2 TB - the theoretical limit for them is 9.4 zettabytes (1021 bytes).
2. There is a Secure Boot function in which you can verify that no malware has changed the OS boot.
3. Networking support, which allows remote configuration and debugging.
4. For use, there must be hardware that supports UEFI.
5. Most UEFI versions support BIOS emulation so that you can install and work with an outdated OS.
6. GPT stores a copy of the partition and boot data and can recover data in case of damage to the main GPT header
7
8
Partition Styles
IPL1 |
446 bytes |
64 bytes |
512 |
|
bytes |
||
|
2 bytes
02/02/2021 |
ISEC 2010 – Cybercrime Investigation Training |
9 |
Bootcode
Disk serial number
Partitions
Signature
10
