Computer Systems Forensic Analysis

MCS Applied Cryptography Robust Software Machine Learning Applied to Security Analysis and Exploration of Vulnerabilities Computer Systems Forensic Analysis Reverse Engineering Identification, Authentication and Authorization Secure Execution Environments Direito da Organização e da Segurança

Computer Systems Forensic Analysis

MCS Applied Cryptography Robust Software Machine Learning Applied to Security Analysis and Exploration of Vulnerabilities Computer Systems Forensic Analysis Reverse Engineering Identification, Authentication and Authorization Secure Execution Environments Direito da Organização e da Segurança

Computer Systems Forensic Analysis
Overview of Cybercrime
Introduction to Digital Forensics
Obtaining Evidences
Data Organization
Storage Devices
Volumes and Partitions
RAM Analysis
Mobile Forensics
Open Source INTelligence
Documentation and Reporting

Powered by GitBook

On this page

Storage Devices

Advanced Technology Attachment Interface

Device Configuration Overlay

Last updated 1 year ago

Device Configuration Overlay (DCO).

added in ATA-6.
with DCO, both BIOS and OS see the same size.
DCO removable is permanent (HPA remotion can be temporary).
allows to hide the disk's real capacity.
- PC makers can buy different brands of discs with different sizes and set them to be the same size.
HPA and DCO can coexist on the same disk.

Identify DCO

on the Linux command line: hdparm --dco-identify /dev/sdX

compare values with: hdparm -Iv /dev/sdX

Remove a DCO area

Linux command line:

with hdparm tool.
it is possible to remove, but not to create a new one.
WARNING – it can destroy data permanently.
to remove DCO and set the disk with the real size.
- hdparm --yes-i-know-what-i-am-doing --dco-restore /dev/sdX

Identify DCO
Remove a DCO area