RE: forensic imaging and the host protected area on ATA drives (was Two hash)

Brian,

I am starting a new thread because this, while a very interesting topic
clearly is not related to the original poster's problem.

> On the other hand, maybe the SETMAX command with the temporary flag has
> never been used on the disk.  Maybe it was executed only with the
> permanent flag and the temporary flag causes some sort of corruption that
> makes it difficult to see even the non-HPA data without recovery
> specialists. <

You lost me here.  Otherwise I agree whole-heartedly with your last post.  I
am more concerned about the following line from the ATA-7 spec:

"These commands are intended for use only by system BIOS or other low-level
boot time process. Using these commands outside BIOS controlled boot or
shutdown may result in damage to file systems on the device."

I assume that any "damage to file systems" would occur as a result of the
user addressable space occupied by the file systems being abruptly curtailed
but the spec doesn't exactly say that.

The prudent course of action is to image the drive as it comes to you and
then image the HPA.  But I don't see any need to re-image the entire drive
since the HPA is logically distinct from the user addressable bytes.

For the reason stated above it would be very poor design for a general use
operating system to ignore the HPA.

Regards,

George.   


-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com