IT Management & Cyber Security

Identifying GUID Partition Table (GPT) in this GPT header will help an  investigator  analyze the layout of the disk including the locations of the partition table, partition area, and backup copies of the header and partition table. Investigators can use cmdlets given below in Windows PowerShell to identify the presence of GPT: Get-GPT Get-GPT command helps investigator to analyze the GUID Partition Table data structure of the hard disk. It requires the use of the -Path parameter which takes the Win32 Device Namespace (ex.\\.\ PHYSICALDRIVE1) for the device from which it should parse the GPT. In case, the investigator uses the Get-CPT on a disk formatted with a Master Boot Record, it will display an error message prompting to use Get-MBR instead. Alternate Method: Open “Computer Management” application and click “ Disk Management ” on the left pane. Right-click on the primary disk (here, Disk 0) and then click Properties In the Device Properties window, click ‘Volumes” tab to...