Inspect and Modify GPT in UEFI Environment

Managing GUID Partition Table (GPT) disks directly from a Unified Extensible Firmware Interface (UEFI) environment allows administrators and developers to inspect, repair, or reconfigure storage devices without booting into a full operating system. This guide covers the essential tools and utilities compiled as native UEFI applications (.efi binaries) or integrated into the UEFI Shell that enable direct analysis and modification of GPT structures, headers, and partition arrays.

1. UEFI Shell Built-in Commands

The standard UEFI Shell (part of the open-source TianoCore EDK II project) includes low-level storage commands that interact directly with the EFI_BLOCK_IO_PROTOCOL and EFI_DISK_IO_PROTOCOL.

  • map: Displays all active device mappings, including block devices (blkX) and file system handles (fsX). It identifies which storage handle corresponds to the raw disk containing the GPT.
  • dblk (Display Block): Reads and outputs raw sectors directly from a block device in hexadecimal and ASCII formats. Because the primary GPT header is located at Logical Block Addressing (LBA) 1, running dblk blk0 1 1 dumps the exact 512-byte (or 4096-byte) header, allowing you to manually verify the EFI PART signature, disk GUID, and partition entry LBAs.
  • gpt: Available in extended UEFI Shell builds, this command parses and verifies both the primary GPT header (LBA 1) and the backup GPT header located at the final LBA of the drive, reporting CRC32 mismatches or corrupted partition entries.

2. UEFI HexEdit (HexEdit.efi)

HexEdit.efi is a native full-screen editor provided in the EDK II repository that can open block devices directly.

  • Capability: Allows direct read and write access to raw disk sectors.
  • Usage: By executing hexedit -b blkX, you can navigate directly to LBA 1 (Primary Header), LBA 2–33 (Partition Table Entries), or the secondary GPT at the end of the drive.
  • Application: Useful for manual data recovery, modifying partition type GUIDs, fixing disk attributes, or manually correcting corrupted header CRC32 values when standard partition tools refuse to load.

3. EDK II DiskPart (DiskPart.efi)

Originating from Intel's embedded system tools and open-source EDK II packages, DiskPart.efi serves as a lightweight, pre-boot equivalent of the Windows DiskPart command-line tool.

  • Capability: Inspects partition boundaries, initializes disks to GPT format, creates new partition entries, and removes existing entries.
  • Usage: Interacts dynamically with UEFI block devices to rewrite partition structures cleanly, automatically calculating and updating the header CRC32 checksums and secondary backup tables.

4. Custom and Ported Utilities

When advanced management is required beyond built-in UEFI Shell tools, several standalone utilities can be compiled for the UEFI architecture:

  • GPT fdisk (gdisk EFI Port): Rod Smith's gdisk is the industry standard for repairing damaged GPT structures and converting MBR to GPT. Although primarily run from Linux or Windows, stripped-down builds and statically linked variants targeting the UEFI Shell environment exist to provide interactive GPT repair directly at the firmware prompt.
  • Custom EDK II EFI Applications: Developers can write targeted UEFI applications using the EFI_PARTITION_INFO_PROTOCOL introduced in modern UEFI specifications. This protocol provides programmatic methods to query partition formats, modify partition table entries, and commit changes back to the drive controllers prior to OS boot.

Key Technical Considerations

When modifying GPT structures directly within a UEFI environment:

  • CRC32 Validation: Manually editing partition entries or the header via HexEdit.efi invalidates the CRC32 checksums stored at byte offset 16 (Header CRC32) and offset 88 (Partition Array CRC32). The UEFI firmware may mark the disk as invalid until both checksums are updated.
  • Dual Header Synchronization: Changes made to the primary GPT must be mirrored to the secondary GPT at the disk's termination LBA to prevent operating systems from flagging the partition layout as damaged.