ptardiff

ptardiff

    The first file containing a partition table dump.


    The second file containing a partition table dump. ptardiff will compare the content of file1 against file2.

The ptardiff command compares two partition tables and reports the differences between them. This is useful for identifying changes made to a disk's partitioning scheme.
The command analyzes the partition tables from two input files, often created using commands like sfdisk or sgdisk. ptardiff then highlights any discrepancies in partition start sectors, sizes, types, or attributes. The output provides a clear indication of how the disk layout has been altered between the two states. This functionality is vital for system administrators performing disk imaging, recovery, or forensic analysis where understanding partition changes is paramount. Understanding these changes can allow for accurate disk cloning, prevent accidental data loss, and analyze malicious activities regarding data modification.

ptardiff relies on the input files containing accurate representations of the partition tables. It's crucial to ensure these files are created using reliable tools and that the disk hasn't been modified since the dumps were taken.
The command primarily focuses on comparing partition parameters and may not detect changes within the file systems contained in these partitions.

The input files for ptardiff are typically created using tools like sfdisk with the -d option or sgdisk. The output of these tools should contain a plain text representation of the partition table.

The command exits with a status of 0 if no differences are found, and a non-zero status if there are any differences.

sfdisk(8), sgdisk(8), fdisk(8)