The host protected area (HPA) and device configuration overlay (DCO) are two areas at the end of SATA and IDE hard disk drives that are only accessible via special utilities but not the operating system, BIOS or general user. Both the HPA and DCO can reside on the same drive, and both areas offer potential storage for hiding small to large amounts of secret data, which forensic analysts must be aware of. See
SATA and
IDE.
Host Protected Area (HPA)
The HPA can contain boot code as well as diagnostics and other utilities, all of which are specific to each drive vendor. The HPA was added with the IDE/ATA-4 specification (see
IDE).
Device Configuration Overlay (DCO)
The device configuration overlay (DCO) lets PC vendors buy drives in a range of sizes from different manufacturers and configure them with the same number of sectors in order to appear the same size to the operating system. The DCO was introduced with the IDE/ATA-6 specification (see
IDE).