Partition Schemas

Apple Partition Map

APFS is not very much described from the forensic perspective. I wonder how much APM is described.

APM and APFS seem to be unable to live together. APFS requires GUID.

GUID Partition Table

GUID is an identifier of the following format: 8-4-4-4-12. There is still a protective MBR at 0 so that Windows will not try to format the disk. Up to 128 partitions, each entry is 128 bytes long -> . The header is located in sector 1. Backup copy at the end of the disk. Uses GUID as partition identifiers.

Up to a 128 partitions, all of them can be set as bootable. Will still have a dummy MBR at sector 0 and it’s there for backwards compatibility.

Master Boot Record

Stands for Master Boot Record.

Primary partitions (bootable). Can have at most 4 bootable partitions, since it’s limited to 4 partition entries in parition table, each entry 16 bytes in length. 4 bytes for their size, hence max value in hex is 0xFF FF FF FF, hence max size of a partition is 2 Tb. It starts at sector 0, it’s 512 bytes long (one sector) and it ends with 0x55 0xAA.

Partition Schemas Overview

Bootcode and Booting Process

Partition tables

Partitioning is the address range where the volume with a file system can sit. You create a partition, then you format it to create a volume with a file system. So, partition and volume are not interchangable terms. Usually, a volume occupies the whole partition, but that’s not always the case. Sometimes, some little address sapce might be left out of the volume, so that this volume would not occupy the whole partition.