Difference between revisions of "DCO and HPA"

From ForensicsWiki
Jump to: navigation, search
(External Links)
 
Line 73: Line 73:
 
* [http://en.wikipedia.org/wiki/Device_configuration_overlay Wikipedia article on Device Configuration Overlay]
 
* [http://en.wikipedia.org/wiki/Device_configuration_overlay Wikipedia article on Device Configuration Overlay]
 
* [http://en.wikipedia.org/wiki/Host_protected_area Wikipedia article on Host Proteced Area]
 
* [http://en.wikipedia.org/wiki/Host_protected_area Wikipedia article on Host Proteced Area]
 +
* [http://www.recover.co.il/SA-cover/SA-cover.pdf Hiding Data in Hard-Drive’s Service Areas], by [[Ariel Berkman]], February 14, 2013

Latest revision as of 16:28, 25 February 2013

Device Configuration Overlay (DCO) and Host Protected Area (HPA).

Detection

Linux

Using hdparm

HPA

Command:

# hdparm -N /dev/sda

Disabled HPA:

/dev/sda:
 max sectors   = 1465149168/1465149168, HPA is disabled

Enabled HPA:

/dev/sdc:
 max sectors   = 586070255/586072368, HPA is enabled

DCO

Command:

# hdparm --dco-identify /dev/sda

Example output:

/dev/sda:
DCO Revision: 0x0001
The following features can be selectively disabled via DCO:
	Transfer modes:
		 mdma0 mdma1 mdma2
		 udma0 udma1 udma2 udma3 udma4 udma5 udma6(?)
	Real max sectors: 1465149168
	ATA command/feature sets:
		 SMART self_test error_log security HPA 48_bit
		 (?): selective_test conveyance_test write_read_verify
		 (?): WRITE_UNC_EXT
	SATA command/feature sets:
		 (?): NCQ SSP

Removing HPA

Linux

Using hdparm

Command:

# hdparm -N p586072368 /dev/sdc

(permanently (!) set max visible number of sectors, see example above)

Other Tools

  • TAFT (The ATA Forensics Tool) claims the ability to look at and change the HPA and DCO settings.
  • SAFE-Block, claims the ability to temporarily remove the HPA and remove the DCO and later return it to its original state.
  • HDD Capacity Restore, a reportedly Free utility that removed the DCO (to give you more storage for your hard drive!)
  • Tableau TD1 can remove the HPA and DCO.
  • Blancco-Pro 4.5 reportedly removes the HPA and DCO to completely obliterate all of that pesky information which might get in the way.

External Links