I'm a student in the Digital Forensics department. I have to create an image of the HPA of my disk. I searched whole documents about creating HPA image ways but all of them are old methods. For instance, The Sleuth Kit version 1.7.3 allows to create it but it was released in 2003 and the newest versions of TSK have no option to do that. I wonder that is there any way to create and investigate HPA part of my disk.

1 Answer 1


It can be done with native Linux commands but HDAT2 makes life much easier.

From their documentation:

enter image description here


  • Thanks, sir. Also, I found that OsForensics Application (Windows) can create HPA Image. Feb 26, 2020 at 17:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .