Hidden Disk Areas: HPA and DCO

This paper focuses on certain manufacturer hidden areas of a hard disk, specifically Host Protected Areas (HPA) and Device Configuration Overlays (DCO). These areas can be problematic for computer forensic investigators, since many of the common industry tools cannot detect the presence of the HPA and DCO. A review of the ATA specifications and recent white papers indicate that these areas can be accessed, modified, and written to by end users using specific open source and freely available tools, allowing data to be stored and/or hidden in these areas. This greatly increases the risk that image acquisitions may not be a true copy of the physical drive in question. This also could result in the obfuscation of data, leading to incomplete or erroneous

• Type: Journal
• Year: 2006
• Where: IJDE
• Authors: Mayank R. Gupta, Michael D. Hoeschele, Marcus K. Rogers
• Keywords: Common Industry Tools, Host Protected Areas, IJDE 2006, Manufacturer Hidden Areas