Is a nasty Host Protected Area (HPA) or Device Configuration Overlay (DCO) lurking on a suspect hard drive? During a forensic investigation, you have to know.
Enter WiebeTech Docks with HPA/DCO detection!
Various software applications exist which allow a user to create or modify a Host Protected Area (HPA) or Device Configuration Overlay (DCO) table on a hard drive. These can be used to "hide" data on a portion of a drive that is invisible to a computer's OS, which complicates analysis of the drive during a forensic investigation.
The HPA/DCO detection now featured in WiebeTech's Docks is a hardware solution which automatically discovers and alerts the forensic investigator to the presence of these hidden areas. In fact, the Docks can be used to detect the presence of HPA/DCO on hard drives without even being attached to a computer. After detection, use your forensic software to examine the area(s).
Of course, WiebeTech's proprietary write-blocking technology is also featured on these Docks (including write-blocked access to the HPA/DCO), giving you necessary tools for your investigations.
HPA/DCO detection is offered on several WiebeTech products.
- Forensic UltraDock™ professional tool featuring IDE/SATA write-blocking over eSATA/FireWire 800/USB.
- Forensic Notebook DriveDock v4 with write-blocked FireWire 800/USB and a sled for 2.5" (laptop size) hard drives.
- Forensic RTX™ Four Bay Enclosure with HPA/DCO detection. Two write-blocked bays (for suspect drives), and two read/write bays (for somewhere to aquire the data to).
