OpenText Tableau Forensic TX1 Imager
The Information Company 51
Image/
Clone
(Source)
will be
imaged/
cloned;
encrypted
state
will be
imaged/
cloned;
encrypted
state
will be
imaged/
cloned;
encrypted
state
will be
imaged/
cloned;
encrypted
state
reads
possible)
will be
imaged/
cloned;
unencrypt-
ed state
will be
imaged/
cloned;
encrypted
state
unlocked
encryption
container
contents
will be
imaged/
cloned;
unencrypt-
drive
starting at
sector/
block 0
drive
starting at
sector/
block 0
drive
starting at
sector/
block 0
drive
starting at
sector/
block 0
writes
possible)
drive
starting at
sector/
block 0
drive
starting at
sector/
block 0
the
unlocked
encryption
container
leaving
encryption
(Dest)
APFS
support
on
destina-
tion)
APFS
support on
destination)
overwrite
existing
format-
ting,
including
overwrite
existing
formatting,
including
BitLocker
writes
possible)
drive
starting at
sector/
block 0
allowed
unlocked
encryption
container
only leaving
encryption
(Source/
Dest)
full drive
starting at
sector/
block 0
drive
starting at
sector/
block 0
drive
starting at
sector/
block 0
drive
starting at
sector/
block 0
reads
possible)
drive
starting at
sector/
block 0
allowed
contents of
unlocked
encryption
container
only
3.3.6 Disabling drive capacity limiting configurations
In the past, the most common method of intentionally limiting the reported capacity of a
drive was by using the ATA HPA (host protected area) or DCO (device configuration
overlay) feature sets. Starting with the ACS-3 (ATA/ATAPI Command Set 3) specification
update, the concept of Addressable Maximum Address (AMA) was introduced. Newer
drives may support this method of limiting the reported drive capacity. TX1 supports all
these methods with automated detection, identification, and notification that will make
dealing with them seamless and easy. From a forensic point of view, it is valuable to
know if HPA, DCO, or AMA are in use. With that knowledge, the forensic practitioner can
make an informed decision about whether or not to acquire data in the hidden regions of
the drive.
Note that these methods (HPA/DCO and AMA) are mutually exclusive. A drive that
supports HPA/DCO will not support AMA, and a drive that supports AMA will not support
HPA/DCO. Also, while HPA and DCO are related features for a given drive, HPA has a
unique attribute (volatile, or temporary, removal) that distinguishes it from DCO and AMA.
For that reason, this section will cover volatile HPA removal as a separate topic before
addressing non-volatile (permanent) removal of HPA/DCO or AMA.
Copyright © 2022 Open Text. All rights reserved. Trademarks owned by Open Text.
To Next Page
Loading...