CHFI Storage Forensics and File System Analysis Practice Question
A forensic analyst finds a partition that uses the Master Boot Record (MBR) scheme. Which of the following is TRUE about the MBR partition table?
⚠ Common exam trap
Many candidates confuse MBR's fixed 64-byte table with GPT's GUID-based entries, or assume MBR supports large disks because modern OSes can still read them, ignoring the 2 TiB addressing limit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It stores partition information in a 64-byte table
The MBR partition table is exactly 64 bytes in size, divided into four 16-byte entries. Each entry stores the starting and ending CHS/LBA addresses, partition type, and boot flag. This fixed-size table is the defining characteristic of the MBR scheme, limiting it to four primary partitions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It uses a 128-bit Globally Unique Identifier (GUID) for partitions
Why it's wrong here
The MBR partition scheme identifies partitions with a 1-byte type code (e.g., 0x07 for NTFS, 0x83 for Linux) placed in a 16-byte entry, not with a 128-bit GUID. GUID-based partition identifiers are a defining feature of GPT, which stores a unique GUID for each partition in its 128-byte entry. Therefore, an MBR-partitioned disk would never use GUIDs for its partitions.
- ✗
It supports disks larger than 2 TiB
Why it's wrong here
Each MBR partition entry contains a 32-bit LBA field for both the starting sector and the total length, giving a maximum addressable capacity of 2^32 × 512 bytes = 2 TiB. Because it cannot address beyond sector 2^32−1, an MBR disk cannot natively support a disk or single partition larger than 2 TiB. GPT was introduced to overcome this limit by using 64-bit LBA values.
- ✓
It stores partition information in a 64-byte table
Why this is correct
In the first sector, offset 446 contains the MBR's 64-byte partition table, which is exactly four 16-byte entries. Each entry encodes the bootable flag, CHS start/end addresses, an 8-bit partition type, and 32-bit LBA start and size fields. This fixed 64-byte table is the definitive MBR structure, making this statement the correct identifying feature.
- ✗
It stores a backup partition table at the end of the disk
Why it's wrong here
MBR exists only in sector 0 (LBA 0) and has no redundancy; nothing in the MBR specification places a second copy of the partition table at the end of the disk. The backup partition table is a GPT feature, where the primary header is at LBA 1 and a backup header/table is stored at the last LBA of the disk. A forensic analyst would not expect to find a trailing MBR table on a legacy MBR disk.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.