Добавил:
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз: Предмет: Файл:
Скачиваний:
118
Добавлен:
02.02.2021
Размер:
1.17 Mб
Скачать

The project has been funded by the European Commission. The Education, Audiovisual and Culture Executive program (EACEA), TEMPUS IV. The content of this presentation reflects the opinion of the author.

Partitions. MBR. GPT.

Developers:

J. Rolnik

T. Willkomm

A. Kühn

A.Snihurov

Partitions and other file system artifacts

Partitions

Partition Styles

MBR Style

GPT Style

MBR

Master Boot Code

Master Partition Table

GPT

Overview

GUIDs

GUID Partition Table Format

02/02/2021

ISEC 2010 – Cybercrime Investigation Training

2

Partitions

A computer cannot address a physical hard drive until it’s been partitioned (or initialized) and the MBR written to disk, with at least one partition identified

Partitions are contiguous areas of the drive reserved for Logical Drives

Partitions may be defined in the MBR Partition Table or within a GPT Partition Entry

02/02/2021

ISEC 2010 – Cybercrime Investigation Training

3

BIOS

Basic Input-Output system

UEFI

Unified Extensible

Firmware Interface

UEFI support in the Windows operating system appeared with the release of Windows Vista Service Pack 1 and Windows 7

BIOS-MBR

MBR

Initial Program Load (IPL1)

active partition

(VBR)

Volume Boot Record

Initial Program Load (IPL2)

(80h flag)

UEFI-GPT

GPT

GUID Partition Table

EFI

Extensible Firmware

Interface

FAT-32

hidden

boot process

operating system

Bootmgr

operating system

Bootmgr

4

Operating system boot structure (BIOS-MBR)

5

Partition Styles

Partition Style refers to the method that the operating system organizes partitions on a disk

MBR

̶4 Primary or 3 Primary and 1 Extended

̶Extended Partition can be divided into 1 or more logical volumes

GPT

̶Up to 128 Partitions

Other Types of Partition Styles

̶Apple Partition Map

̶?

02/02/2021

ISEC 2010 – Cybercrime Investigation Training

6

BIOS-MBR

Download only from hard drives of not more than 2.1 TB.

UEFI-GPT

1. UEFI firmware can boot from disks larger than 2.2 TB - the theoretical limit for them is 9.4 zettabytes (1021 bytes).

2. There is a Secure Boot function in which you can verify that no malware has changed the OS boot.

3. Networking support, which allows remote configuration and debugging.

4. For use, there must be hardware that supports UEFI.

5. Most UEFI versions support BIOS emulation so that you can install and work with an outdated OS.

6. GPT stores a copy of the partition and boot data and can recover data in case of damage to the main GPT header

7

8

Partition Styles

IPL1

446 bytes

64 bytes

512

bytes

 

2 bytes

02/02/2021

ISEC 2010 – Cybercrime Investigation Training

9

Bootcode

Disk serial number

Partitions

Signature

10