CHFI Storage Forensics and File System Analysis Practice Question
During a forensic investigation of a hard disk, the investigator finds that the partition table is missing. The disk was previously partitioned using GPT. Which area of the disk should be examined to recover the GPT partition table?
⚠ Common exam trap
The CHFI exam often tests the misconception that the GPT partition table is stored in the MBR (LBA 0) or the last sector, but the primary GPT header is specifically at LBA 1, while the backup is at the last sector.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
LBA 1 (sector 1)
In GPT (GUID Partition Table) disks, the primary partition table is stored in LBA 1 (sector 1), immediately following the protective MBR at LBA 0. When the partition table is missing, examining LBA 1 allows recovery of the GPT header, which contains pointers to the partition entry array. This is the correct location because GPT uses LBA 1 for its header, not the last sector or the MBR.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Last sector of the disk
Why it's wrong here
The very last sector of a GPT disk holds a backup copy of the GPT header and its partition entry array, providing redundancy for recovery if the primary structures are corrupted. However, it is not the location the UEFI firmware or operating system reads first when interpreting the disk layout. The primary GPT header and partition entries are anchored at LBA 1, so this option incorrectly points to the backup rather than the primary partition table.
- ✗
Volume boot record
Why it's wrong here
A volume boot record (VBR) is the first sector of an individual partition, not of the physical disk, and contains filesystem boot code and a BIOS Parameter Block for volumes formatted with NTFS, FAT32, or similar. It exists inside a partition and has no role in defining disk-wide partition layout. Therefore, the VBR cannot contain the GPT partition table, which resides at the disk level beginning at LBA 1.
- ✗
Master Boot Record (LBA 0)
Why it's wrong here
On a GPT-partitioned disk, LBA 0 contains only a protective Master Boot Record, which is a legacy compatibility structure. Its sole partition entry is of type 0xEE, covering the entire disk to prevent older MBR-only tools from thinking the disk is unformatted. The actual GPT header and partition entries are not stored in this sector; they begin at LBA 1, so selecting the MBR at LBA 0 is incorrect.
- ✓
LBA 1 (sector 1)
Why this is correct
The primary GPT header is stored at LBA 1 (sector 1), immediately following the protective MBR at LBA 0. This header contains the disk GUID, the location of the partition entry array (typically LBA 2–33), entry counts, CRC32 integrity checks, and pointers to the backup GPT at the last sector. Because the GPT layout specifically starts here, LBA 1 is the correct answer.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.