GUID Partition Table (GPT)
| Format | GUID Partition Table (GPT) |
|---|---|
| Short name | GPT |
| Category | filesystem |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
The UEFI partition scheme: a header in the second logical block, a partition entry array with a type GUID, unique GUID, start and end LBA and a UTF-16 name per partition, and a backup copy of both at the end of the disk. Both copies carry CRC32 checksums, so a primary and backup that disagree show the table was changed or damaged. Used by current Windows, macOS, Linux and Android devices; on 4Kn disks the header sits at byte 4096 instead of 512.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 512 (0x200) | 45 46 49 20 50 41 52 54 | EFI PART | GPT header signature in LBA 1 (512-byte sectors) |
| offset 4096 (0x1000) | 45 46 49 20 50 41 52 54 | EFI PART | GPT header signature in LBA 1 (4096-byte sectors) |
Known extensions
None recorded
References
- UEFI Specification 2.10 — GUID Partition Table (GPT) Disk Layout https://uefi.org/specs/UEFI/2.10/05_GUID_Partition_Table_Format.html
- GUID Partition Table (GPT) format (libyal/libvsgpt) https://github.com/libyal/libvsgpt/blob/main/documentation/GUID%20Partition%20Table%20(GPT)%20format.asciidoc
- ForensicsWiki — GPT https://forensics.wiki/gpt/
- abrignoni/qnxprobe — MBR/GPT, LVM2 and filesystem reader for raw images (QNX6/QNX4, ETFS, EFS, ext2/3/4, F2FS, FAT32/16/12, exFAT, NTFS, HFS+, APFS, QNX IFS, SquashFS, JFFS2, UBI/UBIFS, YAFFS) https://github.com/abrignoni/qnxprobe
Cite this entry
Crush Format Reference, “GUID Partition Table (GPT)”. https://kalink0.github.io/crush-forensics/formats/gpt/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction