All

I am practicing computer forensics and wanted to know if there is a program that can make a hard drive appear to be a particular size. The reason why I need this is because when restoring a forensic dd image to a larger hard drive, the hashes will not match the original hash of the dd image. The hash difference can cause a lot of headaches from a legal stand point.

If anyone knows of a tool, please let me know, I will greatly appreciate it.

Regards,
Taurean

For (S)ATA drives, you can research the HPA (Host Protected Area) feature set in the ATA specification. Note that there are some drive f/w bugs in this area and not all drives support this optional HPA part of the ATA specification at all. You can try utilities like MHDD & HDAT2 to manipulate the HPA, on drives which support the HPA feature set.

No need for hpa. Use mhdd , command CONFIG and set max Lba to desired value. Confirm, power off and on and check (F2). Done.

Good point, that's an alternative. For the benefit of other readers, in that case MHDD is sending commands from the (also optional) DCO (Device Configuration Overlay) feature set, so the drive needs to support that...


That depends on the drive, BlackST, things are not quite so "black and white" I currently have a drive on my bench which supports HPA but not DCO, so using HPA would be the only (user-available) option to reduce the reported capacity on that one. However your point is taken, that using DCO commands (e.g. via MHDD or HDAT2) may be an alternative for the OP.

You're right but as far as I can see (and I handle hundreds of drives per day) the only drives at hand that do not support the DCO are the oldest below 10GB - example : Samsung SV0xxxx , WU , WR and smallest WD.

A 15 GB , so let's say a Quantum LCT or around same "age" can be configured. Same for a SV1021 (10GB Samsung) and other old 2,5".

Another alternative would be handling internal tables but it requires dedicated tools (and know how about FW).

Indeed, that's always an option for pros like you but that's why I deliberately left it out of the options that I explained to the OP were available to users.

Interestingly the drive I have here without DCO support is brand new, so not from your list of older drives - but since I hardly ever use that feature, I wasn't aware that lack of DCO is rare, based on your (much larger) experience of drives. Thanks for that.

Out of curiosity, what is that drive ?

Also, you have PM !