Tableau TX1, User Manual

Page: 97 / 125

Disabling HPA and DCO
The TX1 automatically detects the use of the ATA HPA (host protected area) and DCO (device
configuration overlay) feature sets. Both HPA and DCO feature sets can be used to reduce the
apparent capacity of a drive. From a forensic point of view it is valuable to know if HPA or DCO
are in use. With that knowledge, the forensic practitioner can make an informed decision
about whether or not to acquire data in the hidden regions of the drive.
HPA can be disabled without making a permanent modification to the drive, so the TX1
automatically disables HPA on any drive connected to the source side of the duplicator. It is
not, however, possible to disable DCO without making a permanent modification to the drive.
For this reason, the TX1 does not automatically disable DCO on the source drive.
Note: Disabling an HPA on a source drive happens in two distinct ways on TX1.
Upon initial source drive detection, a detected HPA is automatically disabled in a
volatile (or temporary) manner. This will only last as long as the drive is powered
(either by the TX1 or external power). Power cycling a drive that had its HPA
disabled in this manner will automatically return it to its original state. Using the
HPA/DCO Disable media utility on TX1 will permanently disable the HPA setting.
Use caution when using the HPA/DCO Disable media utility as both the HPA and
DCO settings will not be able to be reapplied directly by the TX1. Creating a clone
of a given source drive before permanently disabling HPA/DCO is highly
recommended.
The TX1 never makes automatic changes to HPA and DCO on a destination drive. The TX1 is
designed to give the forensic practitioner complete control over the destination drive. If you
choose to restrict the destination drive capacity using HPA or DCO, the TX1 will not override
that decision.
The HPA/DCO Disable media utility permanently disables the HPA and DCO on the source
drive. You cannot remove a DCO-protected region on a drive without also removing any HPA-
protected region.
If a drive has a DCO configured, a red warning message displays on the drive tile indicating DCO
is limiting the drive size. Disable an HPA and/or DCO from the Drive Details screen for a given
drive. Drive Details can be viewed through the Sources and Destinations areas of the main
Home page or from the Select a Source or Select a Destination areas during Duplication job
setup.
CHAPTER 4 Using the TX1 97