Hard Drives - Host Protected Area (HPA) and Device Configuration Overlay (DCO)

Discussion in 'backup, imaging & disk mgmt' started by TheKid7, Jun 5, 2013.

Thread Status:
Not open for further replies.
  1. TheKid7

    TheKid7 Registered Member

    Joined:
    Jul 22, 2006
    Posts:
    3,469
    Hard Drives - Host Protected Area (HPA) and Device Configuration Overlay (DCO)

    Does anyone know if Malware can hide and be active in either one or both of these areas? It is my understanding that most hard drive wiping tools will not wipe these two areas.

    Thanks in Advance.
     
  2. Jim1cor13

    Jim1cor13 Registered Member

    Joined:
    Aug 4, 2012
    Posts:
    453
    Location:
    US
    Hi TheKid7 :)

    Perhaps this older wilders post will offer some insight:
    https://www.wilderssecurity.com/showthread.php?t=194590

    It contains some good reference material and I think may help address your question/concern regarding the HPA/DCO.

    Also here from the above forum link: http://en.wikipedia.org/wiki/Host_Protected_Area

    It comments further in the article from Wikipedia: "Some rootkits hide in the HPA to avoid being detected by anti-rootkit and antivirus software."

    It also gives reference to the book 'The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System' written by Bill Blunden.

    I hope this helps in some way. Have a good day TK7 :)

    Jim
     
Loading...
Thread Status:
Not open for further replies.