Difference between revisions of "DCO and HPA"

From ForensicsWiki
Jump to: navigation, search
Line 56: Line 56:
<pre># hdparm -N p586072368 /dev/sdc</pre>
<pre># hdparm -N p586072368 /dev/sdc</pre>
(set max visible number of sectors, see example above)
('''permanently''' (!) set max visible number of sectors, see example above)
== Other Tools ==
== Other Tools ==

Revision as of 20:11, 26 December 2008



Using hdparm



# hdparm -N /dev/sda

Disabled HPA:

 max sectors   = 1465149168/1465149168, HPA is disabled

Enabled HPA:

 max sectors   = 586070255/586072368, HPA is enabled



# hdparm --dco-identify /dev/sda

Example output:

DCO Revision: 0x0001
The following features can be selectively disabled via DCO:
	Transfer modes:
		 mdma0 mdma1 mdma2
		 udma0 udma1 udma2 udma3 udma4 udma5 udma6(?)
	Real max sectors: 1465149168
	ATA command/feature sets:
		 SMART self_test error_log security HPA 48_bit
		 (?): selective_test conveyance_test write_read_verify
	SATA command/feature sets:
		 (?): NCQ SSP

Removing HPA


Using hdparm


# hdparm -N p586072368 /dev/sdc

(permanently (!) set max visible number of sectors, see example above)

Other Tools

  • SAFE-Block, claims the ability to temporarily remove the HPA and remove the DCO and later return it to its original state.
  • HDD Capacity Restore, a reportedly Free utility that removed the DCO (to give you more storage for your hard drive!)
  • Blancco-Pro 4.5 reportedly removes the HPA and DCO to completely obliterate all of that pesky information which might get in the way.


  • Hidden Disk Areas: HPA and DCO, Mayank R. Gupta, Michael D. Hoeschele, Marcus K. Rogers, International Journal of Digital Evidence, Fall 2006, Volume 5, Issue 1