User`s guide

44
DCO allows systems to modify the apparent features
provided by a hard disk drive device. DCO provides a set
of commands that allows a utility or program to modify
some of the modes, commands and feature sets supported
by the hard disk drive. DCO can be used to hide and
protect a portion of the drive’s area from the operating
system and file system. If DCO is detected on a Suspect’s
drive, the Forensic Disk Jockey copy operation will capture
all the contents of the drive’s sectors, including all the DCO
hidden sectors, to the evidence drive.
The DCO specification includes instructions to modify
some of the drive’s functions or behavior. Both the DCO
and HPA specifications include instructions to modify the
drive’s capacity. For example one of the DCO or HPA
commands allows programming the drive with a smaller
number of sectors than the native number of sectors
physically supplied by the drive. By manipulating this area
on the disk, one can artificially restrict access to the full
area of a drive making the drive appear to be smaller. Data
could then be stored in the “DCO” or “HPA” area, hidden
and protected from the O/S.