CHFI Storage Forensics and File System Analysis Practice Question
During a forensic investigation, an analyst discovers data hidden in the Host Protected Area (HPA) of a hard drive. Which tool is commonly used to view and access the HPA?
⚠ Common exam trap
The EC-CHFI exam often tests the misconception that dd can directly access the HPA, but dd only reads the logical block addresses visible to the OS, which excludes the HPA until it is explicitly revealed with hdparm.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
hdparm
D (hdparm) is correct because the Host Protected Area (HPA) is a reserved area on an ATA/IDE hard drive that can be accessed and manipulated using ATA commands. The hdparm utility in Linux provides the -N flag to view and change the HPA size, allowing an analyst to detect and access hidden data stored in this region.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
PhotoRec
Why it's wrong here
PhotoRec carves file signatures from accessible sectors, so it cannot read the HPA, which the drive firmware conceals from normal LBA addressing until an ATA SET MAX command unlocks it. PhotoRec is the right choice for recovering deleted files from unallocated space or formatted media, not for hidden drive regions.
- ✗
fdisk
Why it's wrong here
fdisk partitions the visible addressable space and cannot read the HPA, which lies beyond the drive's reported maximum sector. It is tempting because fdisk is a genuine low-level disk utility, and it would be correct for inspecting or altering partition tables on standard drives.
- ✗
dd
Why it's wrong here
dd copies addressable sectors but cannot issue the ATA SET MAX command needed to expose the HPA, so it reads only the visible LBA range. dd is the right choice for imaging a drive or copying raw data once the full addressable capacity is already accessible.
- ✓
hdparm
Why this is correct
hdparm issues ATA commands that read the drive's maximum addressable sector count and can unlock or reveal the Host Protected Area, which the BIOS and OS normally hide. It is the standard Linux utility for inspecting and accessing HPA regions during forensic examination.
Go deeper
Related to this question
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.