Partition Schemas

Apple Partition Map

APFS is not very much described from the forensic perspective. I wonder how much APM is described.

GUID Partition Table

GUID is an identifier of the following format: 8-4-4-4-12. There is still a protective MBR at 0 so that Windows will not try to format the disk.

Master Boot Record

Stands for Master Boot Record. Primary partitions (bootable). Can have at most 4 bootable partitions, since it’s limited to 4 partition entries in parition table, each entry 16 bytes in length.

Partition Schemas Overview

Bootcode and Booting Process Partition tables Partitioning is the address range where the volume with a file system can sit.