CHFI Storage Forensics and File System Analysis Practice Question
An analyst discovers a hidden partition on a hard drive that does not appear in the standard MBR partition table. The drive uses GPT partitioning. Which area of the disk should be examined to find evidence of a hidden partition?
⚠ Common exam trap
EC-CHFI often tests the misconception that the MBR is the primary source of partition information on GPT disks, leading candidates to incorrectly choose Option A, when in fact the protective MBR is only a compatibility placeholder and the real partition data resides in the GPT structures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The GPT header and partition entry array located after the protective MBR
In GPT partitioning, the protective MBR in sector 0 only contains a single partition entry of type 0xEE to prevent legacy tools from misinterpreting the disk. The actual partition information, including any hidden partitions, is stored in the GPT header (typically in sector 1) and the partition entry array that follows. Therefore, examining the GPT header and partition entry array is necessary to detect partitions not visible in the MBR.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Master Boot Record (MBR) in sector 0
Why it's wrong here
The Master Boot Record (MBR) in sector 0 is not the correct location. In a GPT disk, sector 0 contains a protective MBR whose partition table is intentionally minimal: it typically holds a single entry of type 0xEE covering the entire disk (or a portion of it) to prevent legacy tools from misinterpreting the GPT layout. This protective MBR does not enumerate hidden partitions, and GPT partition entries are stored elsewhere, so examining only the MBR would not reveal a hidden GPT partition.
- ✓
The GPT header and partition entry array located after the protective MBR
Why this is correct
The GPT header and partition entry array located after the protective MBR are exactly where partition definitions live on a GUID Partition Table disk. The primary GPT header is at Logical Block Address 1 (right after the protective MBR in sector 0), and the partition entry array follows it; the header contains the partition table checksum and pointers to the entries, while the entries themselves (with unique GUIDs, start/end LBAs, and attributes) define each partition. A hidden partition may be deliberately omitted from the active partition table, but a forensic analyst scanning the entire disk for GPT-like structures—such as the header signature 'EFI PART' and backup headers at the end—can locate an alternate or stale partition entry array that reveals the hidden partition's existence and location.
- ✗
The Volume Boot Record (VBR) of the C: drive
Why it's wrong here
The Volume Boot Record (VBR) of the C: drive is not the right location because a VBR is the boot sector of an individual partition, not a container for partition table metadata. It contains boot code relevant to the filesystem (e.g., NTFS or FAT32) and filesystem parameters like bytes per sector, cluster size, and volume serial number, but it does not list other partitions or hidden partitions on the disk. In fact, the VBR resides within a partition, and its offset from the start of the disk depends on the partition's starting LBA; it cannot provide a global view of the disk's partition layout.
- ✗
The Host Protected Area (HPA) at the end of the disk
Why it's wrong here
HPA is a feature used to hide a portion of the disk from the OS, but it is not a partition table. A hidden partition could be placed within HPA, but HPA itself is not a partition table.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.