CHFI Host Protected Area (HPA) Practice Question
An analyst is examining a USB drive that appears to have a smaller capacity than expected. The drive is detected as 8 GB but only 7 GB is accessible. Which of the following is the most likely cause?
⚠ Common exam trap
The CHFI exam often tests the distinction between HPA (reduces total reported capacity) and hidden partitions (allocate space but do not change total reported capacity). Candidates may mistakenly think both apply, but the key is that only HPA causes a discrepancy in total detected capacity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The drive has a Host Protected Area (HPA) hiding 1 GB
The difference between detected capacity (8 GB) and accessible space (7 GB) is most likely due to a Host Protected Area (HPA). HPA uses the ATA SET MAX ADDRESS command to reduce the total capacity reported by the drive, effectively hiding 1 GB from the operating system. A hidden partition does not change the total reported capacity; it only makes a portion of the space inaccessible by not assigning a drive letter. Therefore, only HPA directly reduces the total capacity, making option C the most likely cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file system uses a cluster size that wastes space
Why it's wrong here
Cluster slack is the wasted space between the logical file size and the allocated cluster size, but on an 8 GB drive with typical 4 KB clusters, even with many files the cumulative slack rarely approaches 1 GB. Also, cluster size does not alter the total LBA count or the raw capacity reported to the operating system; it only slightly reduces the effective usable space during formatting. Thus, while cluster waste reduces free space, it cannot account for the entire 1 GB discrepancy in total reported capacity.
- ✗
The drive is formatted with FAT32 which has a 4 GB file size limit
Why it's wrong here
FAT32's well-known 4 GB maximum file size limits individual files, not the total volume capacity or the number of LBAs reported by the drive. An 8 GB FAT32 volume still appears as 8 GB to the OS, though it may have slight overhead from filesystem structures. The observed discrepancy is a 1 GB shortfall in total disk capacity, which is fundamentally different from a file-size constraint that would only cause errors when writing a single file exceeding 4 GB, not a reduction in reported capacity.
- ✓
The drive has a Host Protected Area (HPA) hiding 1 GB
Why this is correct
A Host Protected Area (HPA) is a region at the end of a hard drive defined via the ATA SET MAX ADDRESS command that reduces the reported LBA count, making the disk appear smaller to the operating system. If an 8 GB drive reports only 7 GB, an HPA can hide exactly 1 GB of sectors, which remain inaccessible to the OS and typical file system tools. This precisely matches the observed discrepancy, and forensic examiners can detect it using ATA commands (e.g., hdparm -N) or specialized tools that compare the reported and actual maximum addresses.
- ✗
The drive contains a hidden partition
Why it's wrong here
A hidden partition is a partition entry in the master boot record or GPT that is flagged as hidden or uses an unrecognized type, preventing the OS from assigning it a drive letter and mounting it. However, the partition table still contains the partition's descriptors, and the disk's total capacity—including the hidden partition—remains visible to the OS as the full 8 GB. Therefore, hiding a partition does not reduce the reported total capacity; it merely leaves part of the space unmounted, so it cannot explain a 1 GB shortfall in the reported disk size.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.