Methods of discovery and exploitation of Host Protected Areas on IDE storage devices that conform to ATAPI-4

This paper explains some of the issues that prevent the easy detection of Host Protected Areas on IDE drives and discusses a variety of methods which may enable examiners to reveal what may be overlooked evidence. We consider some exploitation methods and include a brief examination of EnCase 5.01 image capture as an example.