CRU USB WriteBlocker User Manual
Page 4
CRU-WiebeTech
U s e r M a n u a l f o r F o r e n s i c S o f t w a r e U t i l i t y ( A 9 - 0 0 0 - 0 0 1 3 ) R E V 1 . 2
- 4 -
3.3 “HPA/DCO Behavior” Tab
(Requires USB or FireWire connection)
This tab provides information related to any HPA and/or DCO regions found on the suspect drive. A Host
Protected Area (HPA) and Device Configuration Overlay (DCO) are reserved areas on a hard drive that
are not accessible by the BIOS or OS. Data can be hidden behind an HPA or DCO, like a stage hidden
behind a curtain.
Your WiebeTech forensic product will alert you to the
presence of any HPA or DCO. You may then use
Forensic Software Utility to manage the HPA/DCO
for imaging. There are four modes:
3.3.1 MODE #1: Leave them in place
The HPA and DCO areas will be left “as is” on the
hard drive. This is an “indication only” mode. Your
WiebeTech forensic device’s LED will blink to
indicate the HPA/DCO presence. No other action is
taken.
3.3.2 MODE #2: Remove HPA temporarily but
ignore DCO
This mode temporarily lets the user view information
hidden by an HPA (see behind the curtain). No
permanent changes are made to the hard drive.
When the hard drive is removed from the
WiebeTech forensic device, the HPA is reinstated.
Any DCO is left untouched.
3.3.3 MODE #3: Remove HPA permanently but
ignore DCO.
This mode completely removes the HPA, making the data behind it visible (permanently removes
the curtain). When the hard drive is removed from the WiebeTech forensic device, the HPA is NOT
reinstated. The DCO and data behind it are left untouched.
3.3.4 MODE #4: Permanently remove them both
The HPA and DCO are both completely removed, making all of the data behind them visible (the curtain
is removed from both permanently). When the drive is removed from the WiebeTech forensic device, the
HPA and DCO are NOT reinstated.
Indicates the presence
of HPAs or DCOs
Allows user to view
data within HPAs
Permanently
removes HPAs
Permanently
removes DCOs
MODE #1
●
MODE #2
●
●
MODE #3
●
●
●
MODE #4
●
●
●
●