MBR vs GPT
Definition
Master Boot Record is the legacy partition table at LBA 0, limited to 4 primary partitions and 2 TiB. GUID Partition Table is the UEFI-era replacement, supporting around 128 partitions, GUID identifiers, a backup at the end of the disk, and CRC checksums.
- MBR partition limit
- 4 primary partitions
- MBR size limit
- 2 TiB
- GPT partition count
- Around 128 partitions
- GPT reliability features
- Backup table at disk end, CRC checksums
Common questions
Why does this distinction matter in digital forensic imaging?+
Recognising whether a disk uses MBR or GPT tells an examiner where to expect the partition table, boot code, and any hidden or unallocated space, which affects both acquisition strategy and where to look for artifacts outside recognised partitions.
How does GPT's backup table help forensic recovery?+
Because GPT stores a duplicate partition table at the end of the disk, a corrupted or deliberately altered primary table at LBA 1 can potentially be cross-checked or recovered from the backup copy during examination.
Related terms
- File Slack
- The unused space at the tail of the last cluster of a file. It can contain remnants of whatever previously occupied that...
- Journal (File-System)
- A circular log of file-system changes that allows recovery after a crash. NTFS keeps $LogFile, ext3/ext4 keep a dedicated journal block, APFS...
- Kernel Space vs User Space
- Kernel space is the privileged execution mode where the OS schedules processes, drives hardware and enforces memory protection. User space is the...
- MAC Timestamps
- Modified, Accessed, and Changed or Created times. Different file systems use the letters differently: on POSIX it is mtime, atime, ctime (change...
- Volume Shadow Copy
- Windows' snapshot mechanism (VSS). Creates point-in-time copies of files and folders. Examiners find shadow copies particularly useful because users rarely know the...