Difference between revisions of "DCO and HPA"
From Forensics Wiki
m |
Joachim Metz (Talk | contribs) |
||
| Line 1: | Line 1: | ||
| + | Device Configuration Overlay (DCO) and Host Protected Area (HPA). | ||
| + | |||
== Detection == | == Detection == | ||
| Line 57: | Line 59: | ||
('''permanently''' (!) set max visible number of sectors, see example above) | ('''permanently''' (!) set max visible number of sectors, see example above) | ||
| − | |||
| − | |||
== Other Tools == | == Other Tools == | ||
* [http://www.vidstrom.net/stools/taft/ TAFT (The ATA Forensics Tool)] claims the ability to look at and change the HPA and DCO settings. | * [http://www.vidstrom.net/stools/taft/ TAFT (The ATA Forensics Tool)] claims the ability to look at and change the HPA and DCO settings. | ||
| − | |||
* [http://www.softpedia.com/get/Security/Security-Related/SAFE-Block.shtml SAFE-Block], claims the ability to temporarily remove the HPA and remove the DCO and later return it to its original state. | * [http://www.softpedia.com/get/Security/Security-Related/SAFE-Block.shtml SAFE-Block], claims the ability to temporarily remove the HPA and remove the DCO and later return it to its original state. | ||
| − | |||
* [http://hddguru.com/content/en/software/2007.07.20-HDD-Capacity-Restore-Tool/ HDD Capacity Restore], a reportedly Free utility that removed the DCO (to give you more storage for your hard drive!) | * [http://hddguru.com/content/en/software/2007.07.20-HDD-Capacity-Restore-Tool/ HDD Capacity Restore], a reportedly Free utility that removed the DCO (to give you more storage for your hard drive!) | ||
| − | |||
* [http://www.tableau.com/pdf/en/Tableau_TD1_Product_Brief.pdf Tableau TD1] can remove the HPA and DCO. | * [http://www.tableau.com/pdf/en/Tableau_TD1_Product_Brief.pdf Tableau TD1] can remove the HPA and DCO. | ||
| − | |||
* [http://www.mp3cdsoftware.com/blancco---pro-download-292.htm Blancco-Pro 4.5] reportedly removes the HPA and DCO to completely obliterate all of that pesky information which might get in the way. | * [http://www.mp3cdsoftware.com/blancco---pro-download-292.htm Blancco-Pro 4.5] reportedly removes the HPA and DCO to completely obliterate all of that pesky information which might get in the way. | ||
| − | == | + | == External Links == |
* [http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B7CW4-4HR72JM-2&_user=3326500&_rdoc=1&_fmt=&_orig=search&_sort=d&view=c&_acct=C000060280&_version=1&_urlVersion=0&_userid=3326500&md5=030e6e2928779b385c76658736d11b98 Methods of discovery and exploitation of Host Protected Areas on IDE storage devices that conform to ATAPI-4], Mark Bedford, Digital Investigation, Volume 2, Issue 4, December 2005, Pages 268-275 | * [http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B7CW4-4HR72JM-2&_user=3326500&_rdoc=1&_fmt=&_orig=search&_sort=d&view=c&_acct=C000060280&_version=1&_urlVersion=0&_userid=3326500&md5=030e6e2928779b385c76658736d11b98 Methods of discovery and exploitation of Host Protected Areas on IDE storage devices that conform to ATAPI-4], Mark Bedford, Digital Investigation, Volume 2, Issue 4, December 2005, Pages 268-275 | ||
| − | |||
* [http://www.utica.edu/academic/institutes/ecii/publications/articles/EFE36584-D13F-2962-67BEB146864A2671.pdf Hidden Disk Areas: HPA and DCO], Mayank R. Gupta, Michael D. Hoeschele, Marcus K. Rogers, International Journal of Digital Evidence, Fall 2006, Volume 5, Issue 1 | * [http://www.utica.edu/academic/institutes/ecii/publications/articles/EFE36584-D13F-2962-67BEB146864A2671.pdf Hidden Disk Areas: HPA and DCO], Mayank R. Gupta, Michael D. Hoeschele, Marcus K. Rogers, International Journal of Digital Evidence, Fall 2006, Volume 5, Issue 1 | ||
| − | |||
* [http://www.sleuthkit.org/informer/sleuthkit-informer-20.txt REMOVING HOST PROTECTED AREAS (HPA) IN LINUX], Brian Carrier, SleuthKit Informer #20 | * [http://www.sleuthkit.org/informer/sleuthkit-informer-20.txt REMOVING HOST PROTECTED AREAS (HPA) IN LINUX], Brian Carrier, SleuthKit Informer #20 | ||
| + | * [http://en.wikipedia.org/wiki/Device_configuration_overlay Wikipedia article on Device Configuration Overlay] | ||
| + | * [http://en.wikipedia.org/wiki/Host_protected_area Wikipedia article on Host Proteced Area] | ||
Revision as of 05:51, 27 July 2012
Device Configuration Overlay (DCO) and Host Protected Area (HPA).
Contents |
Detection
Linux
Using hdparm
HPA
Command:
# hdparm -N /dev/sda
Disabled HPA:
/dev/sda: max sectors = 1465149168/1465149168, HPA is disabled
Enabled HPA:
/dev/sdc: max sectors = 586070255/586072368, HPA is enabled
DCO
Command:
# hdparm --dco-identify /dev/sda
Example output:
/dev/sda: DCO Revision: 0x0001 The following features can be selectively disabled via DCO: Transfer modes: mdma0 mdma1 mdma2 udma0 udma1 udma2 udma3 udma4 udma5 udma6(?) Real max sectors: 1465149168 ATA command/feature sets: SMART self_test error_log security HPA 48_bit (?): selective_test conveyance_test write_read_verify (?): WRITE_UNC_EXT SATA command/feature sets: (?): NCQ SSP
Removing HPA
Linux
Using hdparm
Command:
# hdparm -N p586072368 /dev/sdc
(permanently (!) set max visible number of sectors, see example above)
Other Tools
- TAFT (The ATA Forensics Tool) claims the ability to look at and change the HPA and DCO settings.
- SAFE-Block, claims the ability to temporarily remove the HPA and remove the DCO and later return it to its original state.
- HDD Capacity Restore, a reportedly Free utility that removed the DCO (to give you more storage for your hard drive!)
- Tableau TD1 can remove the HPA and DCO.
- Blancco-Pro 4.5 reportedly removes the HPA and DCO to completely obliterate all of that pesky information which might get in the way.
External Links
- Methods of discovery and exploitation of Host Protected Areas on IDE storage devices that conform to ATAPI-4, Mark Bedford, Digital Investigation, Volume 2, Issue 4, December 2005, Pages 268-275
- Hidden Disk Areas: HPA and DCO, Mayank R. Gupta, Michael D. Hoeschele, Marcus K. Rogers, International Journal of Digital Evidence, Fall 2006, Volume 5, Issue 1
- REMOVING HOST PROTECTED AREAS (HPA) IN LINUX, Brian Carrier, SleuthKit Informer #20
- Wikipedia article on Device Configuration Overlay
- Wikipedia article on Host Proteced Area
