CHFI Storage Forensics and File System Analysis Practice Question
What is the primary difference between MBR and GPT partition tables?
⚠ Common exam trap
EC-CHFI often tests the misconception that MBR is older and therefore inferior in all aspects, but the specific trap here is that candidates confuse 'supports larger disks' (MBR does not) with 'integrity checking' (GPT has it, MBR lacks it), leading them to pick Option C or D instead of the correct CRC-based distinction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
GPT uses a cyclic redundancy check (CRC) for integrity; MBR does not
GPT (GUID Partition Table) uses a cyclic redundancy check (CRC32) to verify the integrity of the partition table header and entries, detecting corruption or tampering. MBR (Master Boot Record) lacks any such integrity check, making it vulnerable to undetected corruption. This CRC mechanism is a fundamental design improvement in GPT over MBR.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MBR is used only on Linux; GPT is used on Windows
Why it's wrong here
MBR and GPT are both platform-agnostic partitioning schemes, not tied to any single operating system. MBR originated with IBM PC DOS and is supported by Windows, Linux, macOS, and most legacy BIOS systems, while GPT is part of the UEFI specification and is supported by modern versions of Windows, Linux, macOS, and other Unix-like systems. The real determining factors are the system firmware (BIOS vs UEFI) and disk capacity, not the OS vendor.
- ✓
GPT uses a cyclic redundancy check (CRC) for integrity; MBR does not
Why this is correct
The key integrity advantage of GPT is its use of CRC32 checksums over the protective MBR, the primary GPT header, and each partition entry. These checksums allow firmware and operating systems to detect corruption or accidental overwriting of the partition table, enabling error reporting or automatic recovery from the backup table. MBR, by contrast, has no built-in integrity check, so a damaged partition table can render the disk unreadable with no indication that corruption occurred.
- ✗
MBR supports larger disks than GPT
Why it's wrong here
This statement is the reverse of the truth: MBR is far more limited in capacity than GPT. MBR uses 32-bit logical block addressing (LBA) entries, which with traditional 512-byte sectors caps the maximum addressable disk size at about 2 TiB (2.2 TB). GPT uses 64-bit LBA entries, supporting theoretical maximums beyond 9 zettabytes, which makes GPT mandatory for modern hard drives and SSDs larger than 2 TB.
- ✗
GPT stores the partition table only in the first sector
Why it's wrong here
GPT actually stores redundant copies of the partition table: a primary table in the first data blocks after the protective MBR and a backup table in the final sectors of the disk. This redundancy is a deliberate design feature that allows recovery if the primary GPT header or entries become corrupted. In contrast, MBR occupies only the first sector with a single copy, offering no such fail-safe, which highlights another reason GPT is preferred for critical data storage.
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.