CHFI Storage Forensics and File System Analysis Practice Question

A forensic investigator recovers a hard drive from a suspect's computer. The drive is detected as 120 GB in BIOS, but forensic tools report only 100 GB of addressable space. Which data hiding technique is MOST likely being used?

⚠ Common exam trap

Many exam-takers confuse HPA with DCO, but the key differentiator is that DCO hides space from the BIOS as well, while HPA allows the BIOS to see the full drive but hides space from the OS and forensic tools.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Host Protected Area (HPA)

The Host Protected Area (HPA) is a region on a hard drive that is hidden from the operating system by using the ATA SET MAX ADDRESS command to reduce the reported addressable space. Since the BIOS detects the full 120 GB but forensic tools see only 100 GB, the HPA is the most likely technique, as it creates a hidden area beyond the reported maximum LBA that is not visible to standard forensic acquisition tools unless specifically addressed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Device Configuration Overlay (DCO)
Why it's wrong here
Device Configuration Overlay (DCO) is an ATA feature that can hide the entire drive capacity from the host, but it is implemented via a DEVICE CONFIGURATION SET command and is stored separately from the HPA. It is less commonly the cause of a capacity mismatch seen in BIOS because it requires deliberate host configuration, whereas HPA is more typically encountered. Forensic examiners must still check for DCO using the IDENTIFY DEVICE data and compare it with the native maximum address, but it is not the primary answer here.
✗
Volume slack
Why it's wrong here
Volume slack refers to the space between the end of the last allocated file system cluster and the end of the partition (or the space between the end of the file system and the partition boundary). It is a filing system residual allocation artifact, not a hardware-level mechanism, and it does not shrink the total capacity that the drive reports to the BIOS or operating system. Because it arises from the way the file system formats the partition, it is unrelated to ATA capacity hiding.
✓
Host Protected Area (HPA)
Why this is correct
Host Protected Area (HPA) is an ATA feature that uses the SET MAX ADDRESS command to lower the drive's reported maximum address, causing all sectors beyond that boundary to become inaccessible to the operating system and BIOS. This effectively hides data in the protected area at the end of the physical disk, which is exactly the kind of capacity mismatch that forensic acquisition tools detect by comparing the native maximum address against the current maximum. HPA is the correct answer because it directly addresses the hardware-level capacity reduction described.
✗
Alternate Data Streams (ADS)
Why it's wrong here
Alternate Data Streams (ADS) are an NTFS attribute that allows multiple data streams to be attached to a single file, enabling hidden data to be stored alongside the file's primary content. They are entirely a file system feature, not a hardware-level storage mechanism, and they have no effect on the total capacity reported by the disk. Since the scenario involves a forensic investigator recovering a hard drive and observing a capacity discrepancy, ADS would not produce such a hardware-level size mismatch.

Go deeper

CHFI Storage Forensics and File System Analysis Practice Question

Why each option matters

Option-by-option breakdown

Related to this question