Forensics · 36 tools · nothing uploads

MBR / GPT partitions

Read a disk image's MBR partition table, or its GPT header and partition entries when the MBR is a GPT protective one.

Input

MBR / GPT partitions starts with a disk image's classic MBR table, four entries of type, boot flag, start LBA and sector count. Finding the GPT protective signature instead switches it over to the GPT header, listing each real partition's type, name, range and size. Unused slots and zeroed entries are skipped. A missing 0x55AA boot signature is refused.

Questions

How does it choose between MBR and GPT?

It reads the classic MBR table first, then checks for the 'EFI PART' signature right after it; if found, it switches to reading the GPT header and entries instead.

What does an MBR row show?

Partition number, type name, boot flag, start LBA and sector count.

What does a GPT row show?

Partition name, type (from a built-in GUID table), start and end LBA, and size.

What if the boot sector signature is missing?

The tool refuses, naming the missing 0x55AA signature at bytes 510-511.

Are unused entries listed?

No, both empty MBR slots and zeroed GPT entries are skipped.

Compare

ToolRuns on the CLILive as you type
MBR / GPT partitionsYesNo
PE infoYesNo
Mach-O infoYesNo

Related Forensics tools