Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

2.2.4, forensic software validation and verification methodology, techniques and
frameworks do exist but the tools to support the process are yet to be developed.
5.1.6.2 HPA or DCO
As reviewed in section 2.3.3, hidden areas such as HPA and DCO are one of the
challenging subjects for disk imaging tools. Problems have been encountered during
the configuration of the testing environment. Windows and Linux are the two
execution environments in the tool evaluation. The disk imaging tool AIR is run in
Linux environment. At the beginning of the environment configuration, Ubuntu 10.04
distribution was used as the Linux environment. However, it was soon found that
Linux disabled HPA temporarily (although it was restored after a complete power
down) during the booting process and this contradicted the purpose of the evaluation.
HPA had to be preserved to test the responses of the disk imaging tools. Removing
HPA by default can create problems in some cases. For example, some motherboard
manufacturers may set up a HPA at the end of the hard drive to store a backup copy of
the BIOS to use for restoring corrupted BIOS. Removing the HPA would increase the
likelihood of the backup BIOS being overwritten over time. The data might not be
overwritten immediately but it will be corrupted eventually if the same operating
system has been used for a long period of time. If the disk imaging tool AIR was used
to image the evidence hard disk and Ubuntu automatically removed the HPA area in
the drive, the HPA would be exposed and the data contained, which may be a key
piece of evidence, would be destroyed.
In a hypothetical case, a server is collected from a crime scene as evidence and
the data storage of the server is constructed with Redundant Arrays of Inexpensive
Disks (RAID). Some of the RAIDs were built based on the something called Firmware
RAID or Fake RAID. This kind of RAID does not have the full RAID functionality
and relies on dedicated drivers to operate properly (AtlanticLinux, 2009). It should be
noted that many users might encounter problems when HPA is removed (during the
boot process) and RAID is used simultaneously. An active bug in Ubuntu involves
data loss due to HPA being disabled by default (Whitcroft, 2009). The problem stems
from the RAID metadata stored in HPA. When the HPA is disabled during the boot
process, the data or configuration of the RAID is lost, leading to an unbootable RAID.
108