ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between revisions of "DCO and HPA"

From ForensicsWiki
Jump to: navigation, search
Line 56: Line 56:
<pre># hdparm -N p586072368 /dev/sdc</pre>
<pre># hdparm -N p586072368 /dev/sdc</pre>
(set max visible number of sectors, see example above)
('''permanently''' (!) set max visible number of sectors, see example above)
== Other Tools ==
== Other Tools ==

Revision as of 20:11, 26 December 2008



Using hdparm



# hdparm -N /dev/sda

Disabled HPA:

 max sectors   = 1465149168/1465149168, HPA is disabled

Enabled HPA:

 max sectors   = 586070255/586072368, HPA is enabled



# hdparm --dco-identify /dev/sda

Example output:

DCO Revision: 0x0001
The following features can be selectively disabled via DCO:
	Transfer modes:
		 mdma0 mdma1 mdma2
		 udma0 udma1 udma2 udma3 udma4 udma5 udma6(?)
	Real max sectors: 1465149168
	ATA command/feature sets:
		 SMART self_test error_log security HPA 48_bit
		 (?): selective_test conveyance_test write_read_verify
	SATA command/feature sets:
		 (?): NCQ SSP

Removing HPA


Using hdparm


# hdparm -N p586072368 /dev/sdc

(permanently (!) set max visible number of sectors, see example above)

Other Tools

  • SAFE-Block, claims the ability to temporarily remove the HPA and remove the DCO and later return it to its original state.
  • HDD Capacity Restore, a reportedly Free utility that removed the DCO (to give you more storage for your hard drive!)
  • Blancco-Pro 4.5 reportedly removes the HPA and DCO to completely obliterate all of that pesky information which might get in the way.


  • Hidden Disk Areas: HPA and DCO, Mayank R. Gupta, Michael D. Hoeschele, Marcus K. Rogers, International Journal of Digital Evidence, Fall 2006, Volume 5, Issue 1