I see vague notes on forensic HPA interest, but it's never specific.
What kind of information can be extracted from a PC's HPA?
For law enforcement agencies and forensic experts it is important to detect HPAs and recovery data from it. For one someone could hide some sensitive data in it or there could be evidence or traces if the owner does not know about the HPA.
Obviously if you hide data in the HPA you are obfuscating and there is no question as to what there is in HPA, it's the second part that interests me: "or there could be evidence or traces if the owner does not know about the HPA."
Traces of what?
Funny sidenote to the question (it's about HPA configuration) from http://www.datasolutions.rs/eng/computer-forensics/computer-forensics-digital-evidence-recovery.html
[a] serious danger is configuring SET_MAX_LBA parameters. This command will adjust maximum number of sectors that may be addressed. In this way, savvy cyber criminals may lead inexperienced investigators into thinking that they are examining a disc of let’s say 60GB instead of actual 80GB disc.