112-57: Threat Intelligence EssentialsDemo

Question

Which command can an investigator use to parse GPTs for both types of hard disks, including those formatted with either UEFI or MBR?

A Get-BootSector
B Get-PartitionTable
C Get-ForensicPartitionTable
D Get-GPT

Explanation

Get-ForensicPartitionTable retrieves partition objects from a specified physical disk and supports both MBR and GPT partition tables. The PowerForensics documentation includes examples for parsing MBR partitions and GPT partitions with this cmdlet.

Learn more

PowerForensics: Get-ForensicPartitionTable

112-57: Threat Intelligence EssentialsDemo

AstroTutor

Notes

Readiness

QuestionQ67

Community Discussion