Hello,
Part of GPT involves with to do with legacy MBR tables. On many systems the
MBR does not in any way reflect the GPT. In fact it is recommended that the
MBR table show one partition (with a special type) which occupies the entire
disk so as to prevent legacy software/devices/OS from see a un-partitioned
drive and taking "ownership" thereby destroying data.
One should examine both the MBR tables (fdisk), and GPT (parted). Consider a
complex case one can use legacy MBR tables for good data with a GPT pointing
to "secret" data right in the meddle of a MBR partition.
Regards,
--
Jason Muskat | GCFA, GCUX - de VE3TSJ
____________________________
TechDude
e. Jason@TechDude.Ca
m. 416 .414 .9934
http://TechDude.Ca/
From: Brian Carrier <carrier@digital-evidence.org>
Date: Tue, 07 Nov 2006 17:06:02 -0500
To: <forensics@securityfocus.com>
Cc: Thomas Matthews <thomas@lagged.ca>
Subject: Re: GUID Partition Table (GPT) Recovery
Resent-From: <forensics-return-3397@securityfocus.com>
Resent-Date: Sat, 11 Nov 2006 06:25:33 -0700 (MST)
If you just want to identify the partition layout, you can also use
'mmls' from The Sleuth Kit (which now runs on Windows). You can then
extract the partitions and use any of your favorite tools.
http://www.sleuthkit.org/sleuthkit/
brian
I am interested to know if any of you out there have been
successful at recovering a GPT volume. The "partition style"
as listed under the Volume tab within the disk device
properties states "GUID Partition Table (GPT)".
I am working with a Promise VTrak M500p SCSI RAID device
using the following configuration:
RAID Level: RAID-5
Capacity: 5.9 TB
Stripe: 64KB
Sector: 2KB
Number of Used Physical Drives: 14
I've used Guidance Software's EnCase and AccessData's FTK
Imager (and some random data recovery applications), all are
unable to read the partition information. As mentioned
above, I'm just putting some feelers out to discover your
experiences with GPT. I am mostly interested in reviewing
deleted information (without having to data carve) and
viewing folder structure. I can provide additional
information if required.
