Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

area to backup their Proprietary software or operating system for the purpose of
diagnostics, manage or update users‟ computer systems. It is designed in a way that it
is not easily be accessible, modified or deleted by normal users. Basic Input/Output
System (BIOS) and Operating system normally cannot access these areas and it is
restricted by the disk controller. HPA and DCO areas are one of the testing subjects in
this research.
2.3.4.1 Host Protected Area (HPA)
HPA was first introduced in ATA-4 standard in 2001. HPA is located at the end of the
disk. The starting address of the HPA is the maximum addressable sector plus one.
There are three AT Attachment (ATA) commands (IDENTIFY DEIVCE, SET MAX
ADDRESS and READ NATIVE MAX ADDRESS) that are involved in implementing
an HPA area. Meyrick (2006) has demonstrated how an HPA can be created. First,
IDENTIFY DEVICE is used to query the true size of the disk drive from the
IDE/ATA hard disk controller. Command READ NATIVE MAX ADDRESS can also
be issued to query the true size of the disk drive and this command will always return
the true size of the drive even when the drive has been compartmentalized by HPA.
Then, SET MAX ADDRESS command is issued to the controller to reduce the size of
the drive to less than its true size. If command IDENTIFY DEVICE is used to query
the size of the drive, the Registers of the ATA controller will return the reduced size of
the hard drive due to the existence of the HPA. In addition of the commands described
above, the ATA-6 standard (Technical Committee T13, 2001) introduced 48bit
Logical Block Addressing (LBA) which enables the faster data access and maximum
size of the hard drive up to 144 petabytes. ATA-6 also introduced another command
SEX MAX ADDRESS EXT when 48 bit LBA addressing is implemented. SEX MAX
ADDRESS and SEX MAX ADDRESS EXT are also used to reset the hard drive to its
true size or native size. Modern hard drives with IDE interface are built to conform to
ATA-6 or later standard. Hard drives with SATA interface are built to conform to
ATA-7 or later standard. Software such as hdparm, The Sleuth Kit, ATA Forensics
Tool can be used to identify or detect HPA area in the disk drive. Creating and
implementing HPA in the hard drive can be done by tools such as HDAT2, MHDD
and hdparm.
34