94 䡲 Cyber Forensics Field Manual, Second Edition
Host-Protected Areas and Disk Confi guration Overlay
e Host Protected Area (HPA) as defi ned is a reserved area on a Hard Disk Drive (HDD). It was
designed to store information in such a way that it cannot be easily modifi ed, changed, or accessed
by the user, BIOS, or the OS. is area can contain information ranging from HDD utilities, to
diagnostic tools, as well as boot sector code.
An additional hidden area on many of today’s HDDs is the Device Confi guration Overlay
(DCO). e DCO allows system vendors to purchase HDDs from diff erent manufacturers with
potentially diff erent sizes, and then confi gure all HDDs to have the same number of sectors. An
example of this would be using DCO to m ...