OSForensics™ can discover and expose the HPA and DCO hidden areas of a hard disk, which can used for malicious intent including hiding illegal data. The Host Protected Area (HPA) and Device Configuration Overlay (DCO) are features for hiding sectors of a hard disk from being accessible to the end user.
Detecting
OSForensics will first attempt to detect and display the size of the HPA/DCO hidden areas. If successfully found, they can be removed or imaged, exposing the hidden data.
Removing
Once the HPA and/or DCO hidden areas have been successfully detected, they can be removed so that the data hidden in those sectors can be accessed and analyzed by Raw Disk Viewer and other OSForensics modules.
Imaging
Alternatively, the HPA/DCO hidden areas can be preserved by creating an image of the hidden sectors and saving it into a file. This file can then be analyzed by other OSForensics modules such as the built-in file viewer.
