1

I see vague notes on forensic HPA interest, but it's never specific.
What kind of information can be extracted from a PC's HPA?

From http://robert.penz.name/68/do-you-know-what-a-host-protected-area-hpa-is/

For law enforcement agencies and forensic experts it is important to detect HPAs and recovery data from it. For one someone could hide some sensitive data in it or there could be evidence or traces if the owner does not know about the HPA.

Obviously if you hide data in the HPA you are obfuscating and there is no question as to what there is in HPA, it's the second part that interests me: "or there could be evidence or traces if the owner does not know about the HPA."
Traces of what?


Funny sidenote to the question (it's about HPA configuration) from http://www.datasolutions.rs/eng/computer-forensics/computer-forensics-digital-evidence-recovery.html

[a] serious danger is configuring SET_MAX_LBA parameters. This command will adjust maximum number of sectors that may be addressed. In this way, savvy cyber criminals may lead inexperienced investigators into thinking that they are examining a disc of let’s say 60GB instead of actual 80GB disc.

  • 1
    Hi Manumit - not sure what security question you are asking here – Rory Alsop May 23 '15 at 16:39
  • Asking forensics questions abbout hidden parts of harddrives isn't information security? I'm confused. I rephrased it simpler, maybe that was the problem. – Manumit May 23 '15 at 20:33
  • 1
    The question looks valid to me. It may be a little short, which seems to trigger down votes. Perhaps you could include a couple of links to the vague notes you did find. However, I doubt you're going to get a great answer here; HPA forensics is advanced stuff and I doubt someone skilled in it would be open to discussing it on a public forum. – paj28 May 23 '15 at 21:40
  • 1
    The problem is that there isn't a security question. The answer is: whatever the bios might put in there. Every bios is different and some might not use it. I don't see this as a forensics question but a bios question. – schroeder May 23 '15 at 22:52
  • If the question was how to extract, then there might be a security question. – schroeder May 23 '15 at 22:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.