GPT

Press this button to setup the environment

Using the mmls command analyse /images/diskimg3.dd. Extract the sector offset information for the partitions shown

Protective MBR is the same as a normal MBR but the 64-byte area contains a single 0xEE type Primary partition entry defined over the entire size of the disk. This structure is designed to enable older tools/OS's that cannot read GPT disks to recognize the disk as containing one parition of unknown type with no empty space. The system will then typically refuse to modify the disk unless the user explicitly requests the changes.

In this question we will be using the dd and xxd commands to analyse the first block (LBA 0) of diskimg3.dd. Inspect the partition table of the Protective MBR and using the information fill in the table below. For hex values, format this as 0xaa or 0xaaaaaaaa, depending on the length.

The majority of the information regarding the structure of the GPT disk is contained within the Partition Header.

The primary version of the Partition Header is found in Sector LBA 1 and the backup copy can be found in the last sector of the disk (Last LBA)

The partition table header defines the usable blocks on the disk. It also defines the number and size of the partition entries that make up the partition table.

The EFI stipulates a minimum of 16,384 bytes has to be reserved for the partition table array. This means that there are 128 partition entries reserved, each 128 bytes long.

In this question we will be using the dd and xxd commands to the open the second block of the (LBA 1) of diskimg3.dd in order to complete the table below.

After the GPT Partition Table Header, the Partition Entry Array describes partition using a 128 byte block per entry at a minimum.

The first 16 bytes designate the partition type globally unique identifier (GUID). The second 16 bytes contain a unique GUID for the partition. After this we can find the starting and ending 64-bit LBAs, partition attributes and names.

As is the nature and purpose of GUIDs, no central registry is needed to ensure the uniqueness of the GUID partition type designators. The location of the parition entries array is defined in the GPT header.

Decoding GUID entries

The GUID value is 16 bytes in length and is represented as 5 different hex numbers seperated by dashes (-). An example being:

C12A7328-F81F-11D2-BA4B-00A0C93EC93B

However this is stored on a disk in slightly strange manner. When written to disk the first three numbers are stored as little endian and the final two are stored as big endian. Based on the example from partition table (LBA 2 - diskimg3.dd, offset 0x0000, length 16 bytes), lets decode the GUID value for "Partition type GUID". The first three numbers have to be converted from little endian to big endian. And the last two numbers stay unchanged.

 
Little endian value is as follow: 
 
a2a0 d0eb e5b9 3344 87c0 68b6 b726 99c7 

	    little endian  big endian  
1st number  a2a0d0eb       ebd0a0a2  
2nd number  e5b9           b9e5  
3rd number  3344           4433  
4th number  87c0   	   87c0          - no change  
5th number  68b6b72699c7   68b6b72699c7  - no change 

Partition 1

Partition 2

Partition 3