Referring to the drive details screenshot above, the fact that the HPA has been
removed is reflected in two ways. One, the drive’s Size field reflects the full capacity
of the drive (with HPA removed). And two, the Contents section shows how many
HPA sectors were exposed in red text. Note that this HPA related information is also
captured in the forensic logs.
TD4 never makes automatic changes to any drive capacity limiting configurations
on destination drives. TD4 was designed to give the forensic practitioner complete
control over the destination drive. If you choose to restrict the destination drive
capacity using HPA, DCO, or AMA, TD4 will not override that decision.
4.6. Viewing sources and destinations
ISTD230100-UGD-EN-1
User Guide
43
To Next Page
Loading...
