Lifting HPA and DCO

HPA (host protected area) and DCO (device configuration overlay) features were created by hard drive manufacturers as hidden areas reserved for storing vendor utilities or simply to make a drive appear to have a certain number of sectors (smaller than the actual drive capacity). But it is many years ago that end users learned to modify and write to these areas of hard drives with the help of open source and freely available tools. For digital forensics specialists, it means that without the ability to identify such hidden areas of a drive and image the full physical image including data in these areas, the evidence they get may be incomplete and lead to inaccurate investigative conclusions.

When you connect a hard drive to the TaskForce unit, in addition to the standard Identify device command, Atola TaskForce software automatically sends two commands to look up the drive size as set in drive’s firmware: Read native max address and Device configuration identify. If drive size has been limited by DCO or HPA, TaskForce will draw your attention to these changes by adding the note in red color in the device menu.

To get more details about the modifications that have been made to the drive’s firmware, run Dignostics and see the Firmware section of the Diagnostics report.

There you will see three lines indicating the drive’s Max Address according to different records in the drive’s firmware:

1. The Max Address according to device ID line shows the max address from the ID sector, affected by both HPA and DCO restrictions if those are applied.
2. Native Max Address indicates max address ignoring HPA limitation that may have been enabled, yet affected by DCO restriction.
3. Max Address from DCO is the line that gives you the actual drive size.

A Diagnostics report of a drive that does not have HPA or DCO activated will have the same value in all three lines.

To disable HPA limitations that have been applied to the drive’s firmware, click on the Unclip HPA/DCO subcategory under Other category of the left-side menu and click on Unclip button.

NB Please note that the drive needs to be in the Target mode (use the Source/Target switch on the unit to perform this operation), as Unclip HPA/DCO implies making changes to the drive's firmware, and that is not possible when the drive is in the Source mode.

Atola TaskForce lifts HPA and DCO restrictions in a matter of seconds and enables access to all data on the drive.

Lift HPA until power cycle

To ensure the forensically sound process, it can be necessary to avoid making any changes to the drive. Therefore it is prohibited to disable HPA and DCO restrictions and access data in the hidden areas. With Atola TaskForce it is possible to lift HPA restriction until the next power cycle. This helps avoid permanent changes to the drive.

1. Click Imaging in the left-side Task Menu.
2. Select the Source and the Target.
3. In a pop-up window suggesting you unclip the drive until power cycle, click Yes button.

This will allow temporary access to the data in HPA-protected area, but as soon as you power off or unplug the drive, the HPA will be back again.

NB If a drive freezes in the course of imaging TaskForce forcibly performs power cycles to continue imaging the drive. However, such power cycles will not affect the temporarily disabled HPA. TaskForce will be temporarily removing HPA max address restriction after each power cycle performed during imaging. The HPA-protected area will remain accessible throughout the imaging process.