CHFI Storage Forensics and File System Analysis Practice Question
Which of the following partition table types uses a protective MBR and a GPT header, and is recommended for disks larger than 2 TB?
⚠ Common exam trap
Candidates often mistake Dynamic disk as a partition table type, but it is actually a logical volume manager that can sit on top of either MBR or GPT, so it does not inherently use a protective MBR or GPT header.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
GPT
GPT (GUID Partition Table) is the correct answer because it uses a protective MBR at the first sector (LBA 0) to prevent legacy tools from misidentifying the disk as unformatted, followed by the GPT header at LBA 1. This structure is specifically designed to support disks larger than 2 TB by using 64-bit logical block addresses, overcoming the 2 TB limit of MBR’s 32-bit addressing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MBR
Why it's wrong here
MBR is the traditional partition scheme found on BIOS systems; it uses a single 512-byte boot sector containing partition entries in 32-bit LBA fields, which caps maximum addressable disk size at 2 TiB. It does not use a protective MBR, as it is the master boot record itself and lacks the GPT headers and CRC protection.
- ✗
Dynamic disk
Why it's wrong here
Dynamic disk is a Microsoft proprietary volume management feature that uses Logical Disk Manager (LDM) databases instead of a conventional partition table; it does not define a protective MBR because it operates above the partition layer and can reside on either MBR or GPT disks. Therefore it is not a partition table type.
- ✓
GPT
Why this is correct
GPT (GUID Partition Table) is a modern partition table standard that includes a protective MBR at the first logical block; this MBR contains a single partition entry of type 0xEE that spans the entire disk to prevent legacy BIOS utilities from misinterpreting the disk as unpartitioned. This protective MBR enables GPT to support disks larger than 2 TiB while maintaining compatibility with older tools.
- ✗
APM (Apple Partition Map)
Why it's wrong here
Apple Partition Map (APM) is a legacy partition scheme used on PowerPC-era Macs; it begins with a driver descriptor map and stores partition entries in a block-based map, but it does not include a protective MBR. APM relies on 32-bit block counts, limiting it to 2 TiB disks, so it cannot be the partition table type that uses a protective MBR.
Go deeper
Related to this question
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.