Logo
RSS Feed

Active@ Disk Editor

Apple Partition Map

APFS is not very much described from the forensic perspective. I wonder how much APM is described.

APM and APFS seem to be unable to live together. APFS requires GUID.

GUID Partition Table

GUID is an identifier of the following format: 8-4-4-4-12. There is still a protective MBR at 0 so that Windows will not try to format the disk. Up to 128 partitions, each entry is 128 bytes long -> . The header is located in sector 1. Backup copy at the end of the disk. Uses GUID as partition identifiers.

gpt-struct

Up to a 128 partitions, all of them can be set as bootable. Will still have a dummy MBR at sector 0 and it’s there for backwards compatibility.

Master Boot Record

Stands for Master Boot Record.

Primary partitions (bootable). Can have at most 4 bootable partitions, since it’s limited to 4 partition entries in parition table, each entry 16 bytes in length. 4 bytes for their size, hence max value in hex is 0xFF FF FF FF, hence max size of a partition is 2 Tb. It starts at sector 0, it’s 512 bytes long (one sector) and it ends with 0x55 0xAA.