DCO and HPA

Tools

• TAFT (The ATA Forensics Tool) claims the ability to look at and change the HPA and DCO settings.

• SAFE-Block, claims the ability to temporarily remove the HPA and remove the DCO and later return it to its original state.

References

• Methods of discovery and exploitation of Host Protected Areas on IDE storage devices that conform to ATAPI-4, Mark Bedford, Digital Investigation

Volume 2, Issue 4, December 2005, Pages 268-275

• Hidden Disk Areas: HPA and DCO, Mayank R. Gupta, Michael D. Hoeschele, Marcus K. Rogers, International Journal of Digital Evidence, Fall 2006, Volume 5, Issue 1