Updated ATATool sof...
 
Notifications
Clear all

Updated ATATool software (HPA/DCO/Bad sectors) for Windows

4 Posts
2 Users
0 Likes
5,213 Views
JimC
 JimC
(@jimc)
Posts: 86
Estimable Member
Topic starter
 

I am pleased to announce an updated release of my freely available ATATool software. The updated version can now be used to display/manage Host Protected Area (HPA) and Device Configuration Overlay (DCO) features and simulate 'bad' sectors (with corrupt ECC). The tool works in a standard Windows environment and is broadly similar to the Linux 'hdparm' tool.

I have had quite a few enquiries from the LE community about using the software for ISO 17025 compliance testing. The tool can be used to quickly test your procedures can detect and handle HPA/DCO and 'bad' sectors. The following tips may be helpful

1. The software supports legacy PATA and SATA disks that are directly connected. It does not yet support devices connected via a USB bridge or similar. To see the connected devices use the command

ATATOOL /LIST
2. To see if the device capacity is restricted by HPA/DOC use the command

ATATOOL /INFO \\.\PhysicalDriveX
3. To limit device capacity to 10GB using a DCO use the command

ATATOOL /SETDCO10GB \\.\PhysicalDriveX
4. To limit device capacity to 10GB using an HPA use the command

ATATOOL /SETHPA10GB \\.\PhysicalDriveX
5. To create a simulated 'bad' first sector use the command

ATATOOL /BADECC0 \\.\PhysicalDriveX
6. To verify simulated 'bad' first sector use the command

ATATOOL /VERIFY0 \\.\PhysicalDriveX
There is a readme file supplied with the download which contains more detailed examples.

Please remember

a. This software is dangerous and can damage data / device if incorrectly used. Please experiment on spare devices that you can afford to trash

b. DCO and HPA can be used in combination. In this case the HPA size must be smaller than the DCO.

c. DCO can also be used to 'permanently' disable certain drive features including 48-bit access (which would limit apparent capacity to ~128GB), HPA and security features.

The software is available as a free download on the website (registration required)

www.datasynergy.co.uk/products/misc/atatool.aspx

ATATool is free for private/non-commercial use. I am happy for the software to be used by LE / bona fide forensic practitioners without any further license. However, if your organisation needs written confirmation of this please drop me a line.

I would be happy to answer any questions about the software either here or via email.

Best wishes

Jim

 
Posted : 20/06/2017 6:00 pm
pcstopper18
(@pcstopper18)
Posts: 60
Trusted Member
 

To be clear, you mean LE as in said individual carries a badge correct? "A bona fide forensic practitioner" that does not carry a badge is not included in that statement?

 
Posted : 22/06/2017 12:52 am
JimC
 JimC
(@jimc)
Posts: 86
Estimable Member
Topic starter
 

I have updated the original post to clarify the software license status.

Strictly, it is licensed for private/non-commercial use. In practice, I am happy to grant a free license to any legitimate LE / forensic practitioner who needs one. If the original post is not reassurance enough please drop me a line and I will confirm by email.

Jim

www.binarymarkup.com

 
Posted : 22/06/2017 2:35 pm
JimC
 JimC
(@jimc)
Posts: 86
Estimable Member
Topic starter
 

I am pleased to announce an updated release of my ATATool software. The updated version fixes a problem (crash!) with volume dismounting on some systems and adds Host Protected Area (HPA) security support. ATATool can now report if an HPA password is present and be used to set/lock/unlock and freeze HPA security.

During in testing I have found some BIOS lock/freeze HPA and DCO security during start-up. If these features are 'frozen' they cannot be changed again until the next power-cycle. I have found good results on SATA systems "hot" unplugging the device after system start-up.
Obviously this approach cannot be used for a system drive and should be used with great care!

The complete list of changes in ATATool v1.3.0.20 is as follows

1. Fixed crash on some Windows 7 and later systems when unmounting disk following setting of HPA/DCO
2. Added commands to set HPA security password, lock, unlock and freeze
3. Added /DEBUG command to report detailed ATA registers for investigating problems
4. Report if DCO appears frozen (e.g. empty). May be set by BIOS during startup
5. Report if HPA security feature (password) is enabled. May be set by BIOS during startup
6. Simplified basic syntax help. Use /ADVANCED now displays more information

I remain very grateful for the feedback I have received about this software. I hope it continues to be useful for ISO 17025 testing and similar. Please let me know if you spot any problems or have any suggestions for further features.

The software is available as a free download on the website (registration required)

www.datasynergy.co.uk/products/misc/atatool.aspx

I would be happy to answer any questions about the software either here or via email.

Best wishes

Jim

www.binarymarkup.com

 
Posted : 07/11/2017 12:15 pm
Share: