NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Forensics
Partition and Volume Analysis
Master partition tables and volume analysis. Learn to analyze MBR/GPT structures, uncover hidden partitions, and map complex disk layouts.
Room tasks
1What Is Partition Analysis and Why Does It Matter
2MBR vs GPT Partition Schemes
3Identifying Hidden & Deleted Partitions
4Guided Lab: Analyzing Partition Tables on a Disk Image
Frequently Asked Questions
What is the difference between MBR and GPT?
MBR is the older scheme with a 512-byte boot sector and limited partitions and size, while GPT is the modern scheme with larger capacity and redundant headers. Forensic tools read both.
How can hidden partitions be found?
Compare partition table entries with the disk's actual size and scan for file system signatures in unallocated gaps. Mismatches may reveal hidden or deleted partitions.
Why analyse partitions in forensics?
They define where data lives, and attackers or users can hide data between or outside them. This free intermediate Codelivly room teaches how to map and verify disk layout.