User`s guide

remains write protected in either of the erase modes.

One of the key features of the Forensic Disk Jockey is the

ability to copy the Host Protected Area (HPA) and Device

Conﬁguration Overlay (DCO) areas of a hard disk drive.

Many capture devices (hardware and software) do not

actually copy the HPA and DCO areas of a hard disk

because the device is not designed to detect these areas

and therefore will simply ignore them altogether. A hash

of the source and destination drives will remain consistent

as the HPA and DCO areas are not seen. With a copy done

in mode 3 of the Forensic Disk Jockey the HPA and DCO

areas of the disk are also included in the copy.

The following provides more information on the HPA and

DCO areas of a hard drive.

HOST PROTECTED AREA (HPA)

HPA is deﬁned as a reserved area for data storage outside

the normal operating ﬁle system. This area is hidden from

the operating system and ﬁle system and is normally used

for specialized applications. Systems may wish to store

conﬁguration data or save memory to the hard disk drive

device in a location that the operating systems cannot

change. If an HPA area exists on a Suspect’s drive, the

Forensic Disk Jockey copy operation will detect this area

and capture all the contents of the drive’s sectors, including

all the HPA hidden sectors, to the Destination drive.