CHFI Storage Forensics and File System Analysis Practice Question
During a forensic investigation, an analyst recovers a hard drive that uses GPT partitioning. The analyst needs to locate the backup GPT header to verify partition table integrity. Where is the backup GPT header typically stored on the disk?
⚠ Common exam trap
Candidates often confuse the backup GPT header's location with the primary GPT header (Sector 1) or assuming it resides within a partition, when in fact it is always at the very last sector of the disk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The last sector of the disk
The backup GPT header is stored in the last sector of the disk (LBA -1) to provide redundancy. If the primary GPT header in LBA 1 is corrupted, the backup can be used to reconstruct the partition table. This design ensures the GPT structure can be recovered even if the beginning of the disk is damaged.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The first sector of the last partition
Why it's wrong here
The first sector of the last partition is not the backup GPT header location. GPT places the backup header in the last logical sector of the entire disk, after the backup partition-entry array, not within or at the start of any partition's data area. In standard GPT layout, the first sector of the last partition is simply a data block in the usable region, so it contains no structural GPT metadata. Confusing it with the backup header disregards the fact that the backup header is a disk-level structure anchored to the final LBA, independent of partition boundaries.
- ✓
The last sector of the disk
Why this is correct
The backup GPT header is deliberately written to the last logical sector of the disk (LBA N−1) to provide redundancy if the primary header at LBA 1 is corrupted or lost. It contains a copy of the disk GUID, partition entries' CRC, and the pointer to the backup partition-entry array, allowing full GPT reconstruction. Forensic examiners should read the final sector of the device image, not the last sector of any partition, to locate this structure. This design ensures the partitioning scheme can be recovered even when the primary header is unrecoverable.
- ✗
Sector 0 (the MBR sector)
Why it's wrong here
Sector 0 is the protective MBR, not a GPT header. Its first 512 bytes contain a legacy Master Boot Record with a single partition entry of type 0xEE that marks the disk as GPT and prevents older tools from overwriting it. The primary GPT header starts at LBA 1, immediately following this protective MBR, so any interpretation of sector 0 as the backup header is a category error between legacy and GUID partitioning structures.
- ✗
Sector 1 (immediately after the protective MBR)
Why it's wrong here
Sector 1, or LBA 1, is the location of the primary GPT header, not the backup. After the protective MBR at LBA 0, the primary header is placed at the very next sector and contains the partition entries and pointers; the backup header is mirrored to the end of the disk. The presence of the primary header in this early sector is exactly why it cannot be the backup copy—the backup is specifically placed as far away as possible for fault tolerance. Recognizing this distinction prevents confusing the primary and redundant copies during acquisition.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.