Hidden Areas
Host Protected Area (HPA)
This area should be copied also, it may contain hidden data.
Few tools support reading HPA.
we can use the
hdparmtool to temporarily access it (a reboot will restore the HPA).as a precautionary measure, we should make the first forensic copy with HPA in place.
Device Configuration Overlay (DCO)
The removal of the DCO is permanent, so as a precautionary measure, we should make the first forensic copy with DCO in place.
Few tools support reading DCO areas.
Last updated