|
|
Forensics
DCO discovery Apr 21 2005 11:54AM Nick Puetz (nickpuetz yahoo com) (3 replies) DCO discovery & removal, capabilities of imaging & wiping tools May 11 2005 08:53AM Arne Vidström (arne vidstrom foi se) (1 replies) More about DCO discovery & removal, capabilities of imaging & wiping tools May 26 2005 06:32AM Arne Vidström (arne vidstrom foi se) |
|
Privacy Statement |
>
> > Does anyone know of any good tools or methods for discovering if and
> > ATA hard drive has a device configuration overlay (DCO) area?
Sure, two ATA commands;
READ_NATIVE_MAX_ADDRESS (max sectors accessible)
DEVICE_CONFIGURATION_IDENTIFY (actual # sectors)
These will tell you if the DCO is there. But you'll have to use the
DCO commands to change it (DEVICE_CONFIGURATION_SET and
DEVICE_CONFIGURATION_RESET).
Some docs;
http://www.t13.org/docs2003/e03111r1.pdf
http://www.t13.org/technical/e01108r0.pdf
http://www.t13.org/docs2002/d1410r3b.pdf (pg.90-102)
Commercial tool;
http://www.abcusinc.com/ICS-ImageMASSterSolo2OptionDCO.html
cheers!
farmerdude
http://www.farmerdude.com
<L I N U X F O R E N S I C S>
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
[ reply ]