Forensic analysis of GPT disks and GUID partition tables

Modern computers are beginning to surpass the design limitations of the aging DOS/MBR partition tables and BIOS boot system. As disk sizes begin to exceed two terabytes and hardware vendors begin to transition from BIOS to EFI, understanding GPT disks in forensic examinations becomes useful. This practitioner paper provides an overview of the GUID Partition Table (GPT) scheme from the perspective of the digital forensic investigator. Methods of analysis and acquisition are shown, and artifacts of forensic relevance are identified. The target audience for this paper is digital forensic practitioners and forensic tool developers.