CPT 499C Lecture 3 HPA DCO and Dynamic Disks

CPT 499C Lecture 3 HPA DCO and Dynamic Disks - Hard Drive...

Info iconThis preview shows pages 1–7. Sign up to view the full content.

View Full Document Right Arrow Icon

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
This is the end of the preview. Sign up to access the rest of the document.

Unformatted text preview: Hard Drive Access Slide 1 DEPARTMENT OF COMPUTER & INFORMATION TECHNOLOGY CIT 499C Lecture 3: HPA, DCO and Dynamic Disks Hard Drive Access Slide 2 DEPARTMENT OF COMPUTER & INFORMATION TECHNOLOGY Learning Objectives The student will be able to: Identify the presence of HPA or DCO Explain how HPA or DCO may be used as a forensic tool Describe processing issues associated with HPA / DCO Recognize the presence of a dynamic disk Differentiate between basic and dynamic disks Recover files from a dynamic disk Link a dynamic disk to a host system Hard Drive Access Slide 3 DEPARTMENT OF COMPUTER & INFORMATION TECHNOLOGY Host Protected Area Included in ATA/ATAPI-4 and later specifications ~ 1998 Later versions support password protection Allows setting a Max Address smaller than the Native Max Address Maximum addressable sector of a hard drive can be set lower than the total number of sectors Can be volatile or non-volatile Hard Drive Access Slide 4 DEPARTMENT OF COMPUTER & INFORMATION TECHNOLOGY Host Protected Area Host Protected Area Max Address Native Max Address User addressable sectors Hard Drive Access Slide 5 DEPARTMENT OF COMPUTER & INFORMATION TECHNOLOGY Host Protected Area Only accessible during boot If BIOS support, hot key during POST Recovery diskette Can be used for: Recovery area for pre-installed software OEM diagnostic/emergency recovery tools Duplicate imaging software may not correctly identify entire drive Hard Drive Access Slide 6 DEPARTMENT OF COMPUTER & INFORMATION TECHNOLOGY Sample HPA tools BXDR from Sanderson Forensics Will display FULL sector count on a hard disk. Includes any protected areas. Imaging utilities may miss these areas. BXDR will also allow you to resize a hard disk....
View Full Document

Page1 / 37

CPT 499C Lecture 3 HPA DCO and Dynamic Disks - Hard Drive...

This preview shows document pages 1 - 7. Sign up to view the full document.

View Full Document Right Arrow Icon
Ask a homework question - tutors are online