CHFI Storage Forensics and File System Analysis Practice Question

An analyst is examining a hard drive that was seized from a suspect. The drive is detected as a smaller capacity than listed on the label. Which of the following is the MOST likely explanation?

⚠ Common exam trap

Test-takers frequently confuse file system limits (like FAT32's 2 TB cap) with raw drive capacity reporting, or assume partitioning schemes like GPT inherently reduce capacity, when in fact HPA is the deliberate, forensically significant mechanism for hiding sectors.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The drive has a Host Protected Area (HPA) that hides sectors from the OS

A Host Protected Area (HPA) is a reserved region on an ATA/ATAPI hard drive that can hide sectors from the operating system, making the drive appear smaller than its physical capacity. This is a common anti-forensics technique used to conceal data, and it can be detected and removed using tools like hdparm or ATA Security commands.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The drive has been partitioned with a GPT table, which does not use the full capacity
Why it's wrong here
A GUID Partition Table (GPT) is a partitioning scheme that defines the layout of partitions on a storage device; it does not alter the device's reported capacity from its ATA identify data. In fact, GPT uses the full LBA range and even stores a backup header at the very last sector, so it cannot be the reason the OS sees fewer than the drive's native sectors. The condition described points to a low-level ATA feature that affects the device's addressing, not to the partition table type.
✗
The file system is FAT32, which has a 2 TB limit
Why it's wrong here
FAT32's 2 terabyte limit applies to the maximum size of a single partition/volume, not to the physical capacity of the disk as reported by its ATA Identify Device data. Even on a FAT32 volume, the OS identifies the entire disk and only restricts the partition size; the balance would appear as unallocated space, not as missing sectors. Thus, FAT32 could not cause the drive to report fewer total sectors than the label states; instead, it only limits what can be formatted within one partition.
✗
The drive controller has a firmware bug reporting incorrect size
Why it's wrong here
While a firmware bug could theoretically cause a drive to report an incorrect sector count in response to the IDENTIFY DEVICE command, such a bug would be rare and typically would affect the drive consistently, not just in a forensic context. More importantly, the most common and forensically relevant cause of a drive appearing smaller than its physical capacity is an intentional Host Protected Area (HPA), which is set using standard ATA commands and is easily detected by forensic tools. Attributing the size discrepancy to a firmware bug would ignore the need to check for HPA and Device Configuration Overlay (DCO) during acquisition.
✓
The drive has a Host Protected Area (HPA) that hides sectors from the OS
Why this is correct
A Host Protected Area (HPA) is an ATA feature that allows the maximum LBA address to be set to a value lower than the drive's physical limit, effectively hiding the sectors beyond that point from the operating system. This is performed with the SET MAX ADDRESS command, and the hidden area can contain data deliberately hidden from normal access. Forensic examiners can determine the true native capacity using ATA commands and, with proper write-blocking, remove the HPA to image the entire disk, making this the correct explanation for the observed discrepancy.

Go deeper

CHFI Storage Forensics and File System Analysis Practice Question

Why each option matters

Option-by-option breakdown

Related to this question