hdparm-9.2 now available: w/ DCO and firmware support

hdparm-9.2 now available: w/ DCO and firmware support

[Mark Lord]

hdparm v9.2 is now available from sourceforge.

	http://sourceforge.net/projects/hdparm/

New since v8.9 are:

1. Support for Device Configuration Overlay (DCO),
   with the --dco-identify, --dco-freeze, and --dco-restore flags.
   DCO is a feature set that enables vendors/OEMs to disable/hide
   certain drive features (eg. NCQ, LBA48, ..) for whatever reason
   (eg. compatibility with a specific b0rked BIOS).
   This release of hdparm can display/reset DCO, but not selectively
   disable features yet.

2. Support for firmware download (upgrade) using the
   standard ATA DOWNLOAD_MICROCODE protocols 7 (preferred) and 3.
   This is initiated via the new --fwdownload flag,
   or the --fwdownload80 flag for a non-standard final packet
   (needed by some vendors).

3. Fixed WorldWideName display, and added cache-size display in -I output.

4. Detect/warn of kernel driver bugs in -N output.
   Eg. sata_sil24 misbehaves here in 2.6.25, but is fine in 2.6.27.

5. General fixes and tidiness in the sg16 routines.

Enjoy.

Re: hdparm-9.2 now available: w/ DCO and firmware support

[Greg Freemyer]

On Mon, Nov 3, 2008 at 1:17 PM, Mark Lord <liml@rtr.ca> wrote:
> hdparm v9.2 is now available from sourceforge.
>
>        http://sourceforge.net/projects/hdparm/
>
> New since v8.9 are:
>
> 1. Support for Device Configuration Overlay (DCO),
>  with the --dco-identify, --dco-freeze, and --dco-restore flags.
>  DCO is a feature set that enables vendors/OEMs to disable/hide
>  certain drive features (eg. NCQ, LBA48, ..) for whatever reason
>  (eg. compatibility with a specific b0rked BIOS).
>  This release of hdparm can display/reset DCO, but not selectively
>  disable features yet.
>
> 2. Support for firmware download (upgrade) using the
>  standard ATA DOWNLOAD_MICROCODE protocols 7 (preferred) and 3.
>  This is initiated via the new --fwdownload flag,
>  or the --fwdownload80 flag for a non-standard final packet
>  (needed by some vendors).
>
> 3. Fixed WorldWideName display, and added cache-size display in -I output.
>
> 4. Detect/warn of kernel driver bugs in -N output.
>  Eg. sata_sil24 misbehaves here in 2.6.25, but is fine in 2.6.27.
>
> 5. General fixes and tidiness in the sg16 routines.

Mark,

I'm very happy to see the DCO support go in.

There is a small army of "Computer Forensic" examiners which do their
forensic imaging via Linux and I'm sure many will feel the same.

Thanks
Greg
-- 
Greg Freemyer
Litigation Triage Solutions Specialist
http://www.linkedin.com/in/gregfreemyer
First 99 Days Litigation White Paper -
http://www.norcrossgroup.com/forms/whitepapers/99%20Days%20whitepaper.pdf

The Norcross Group
The Intersection of Evidence & Technology
http://www.norcrossgroup.com

Re: hdparm-9.2 now available: w/ DCO and firmware support

[Mark Lord]

Greg Freemyer wrote:
> On Mon, Nov 3, 2008 at 1:17 PM, Mark Lord <liml@rtr.ca> wrote:
>> hdparm v9.2 is now available from sourceforge.
>>
>>        http://sourceforge.net/projects/hdparm/
>>
>> New since v8.9 are:
>>
>> 1. Support for Device Configuration Overlay (DCO),
>>  with the --dco-identify, --dco-freeze, and --dco-restore flags.
>>  DCO is a feature set that enables vendors/OEMs to disable/hide
>>  certain drive features (eg. NCQ, LBA48, ..) for whatever reason
>>  (eg. compatibility with a specific b0rked BIOS).
>>  This release of hdparm can display/reset DCO, but not selectively
>>  disable features yet.
..
> I'm very happy to see the DCO support go in.
> 
> There is a small army of "Computer Forensic" examiners which do their
> forensic imaging via Linux and I'm sure many will feel the same.
..

Mmm.. never thought about that much before now,
but DCO is a nifty way to hide much of a drive from prying eyes.
Eg. Use DCO to restrict the drive to LBA28 accessible sectors
and also turn off LBA48 support, and then a lot of space becomes "hidden". 

Until now!

Cheers

Re: hdparm-9.2 now available: w/ DCO and firmware support

[Greg Freemyer]

On Tue, Nov 4, 2008 at 1:08 PM, Mark Lord <liml@rtr.ca> wrote:
> Greg Freemyer wrote:
>>
>> On Mon, Nov 3, 2008 at 1:17 PM, Mark Lord <liml@rtr.ca> wrote:
>>>
>>> hdparm v9.2 is now available from sourceforge.
>>>
>>>       http://sourceforge.net/projects/hdparm/
>>>
>>> New since v8.9 are:
>>>
>>> 1. Support for Device Configuration Overlay (DCO),
>>>  with the --dco-identify, --dco-freeze, and --dco-restore flags.
>>>  DCO is a feature set that enables vendors/OEMs to disable/hide
>>>  certain drive features (eg. NCQ, LBA48, ..) for whatever reason
>>>  (eg. compatibility with a specific b0rked BIOS).
>>>  This release of hdparm can display/reset DCO, but not selectively
>>>  disable features yet.
>
> ..
>>
>> I'm very happy to see the DCO support go in.
>>
>> There is a small army of "Computer Forensic" examiners which do their
>> forensic imaging via Linux and I'm sure many will feel the same.
>
> ..
>
> Mmm.. never thought about that much before now,
> but DCO is a nifty way to hide much of a drive from prying eyes.
> Eg. Use DCO to restrict the drive to LBA28 accessible sectors
> and also turn off LBA48 support, and then a lot of space becomes "hidden".
> Until now!

Yeah, combine that with some HPA shenanigans and you can create two
complete disk partition layouts on one drive.

ie. Two partition tables, the normal partition table for the first 128
GiB is in sector 1.  The partition table for the rest of the disk is
at sector 128 GiB + 1.  Then use DCO to totally hide the upper section
of the drive.

When you want access, use DCO commands to expose it, and then HPA
commands to make only the sectors beyond 128 GiB accessible.

FYI: I don't know if hdparm supports doing that via HPA, but there are
tools that do.  Basically you put a HPA area in place from 128 GiB +1
to the end of the disk, then issue a "hpa swap" command.  That will
hide the first 128 GiB and expose the rest of the disk.

Greg
-- 
Greg Freemyer
Litigation Triage Solutions Specialist
http://www.linkedin.com/in/gregfreemyer
First 99 Days Litigation White Paper -
http://www.norcrossgroup.com/forms/whitepapers/99%20Days%20whitepaper.pdf

The Norcross Group
The Intersection of Evidence & Technology
http://www.norcrossgroup.com

Re: hdparm-9.2 now available: w/ DCO and firmware support

[Mark Lord]

Greg Freemyer wrote:
> On Tue, Nov 4, 2008 at 1:08 PM, Mark Lord <liml@rtr.ca> wrote:
..
>> Mmm.. never thought about that much before now,
>> but DCO is a nifty way to hide much of a drive from prying eyes.
>> Eg. Use DCO to restrict the drive to LBA28 accessible sectors
>> and also turn off LBA48 support, and then a lot of space becomes "hidden".
>> Until now!
> 
> Yeah, combine that with some HPA shenanigans and you can create two
> complete disk partition layouts on one drive.
> 
> ie. Two partition tables, the normal partition table for the first 128
> GiB is in sector 1.  The partition table for the rest of the disk is
> at sector 128 GiB + 1.  Then use DCO to totally hide the upper section
> of the drive.
> 
> When you want access, use DCO commands to expose it, and then HPA
> commands to make only the sectors beyond 128 GiB accessible.
..

Now that one has me stumped.  The only HPA commands I know of,
permit setting only the maximum-LBA, not the minimum.
Or is this a newish ATA9 (or last-minute ATA8) sort of thing ?
..
> to the end of the disk, then issue a "hpa swap" command.  That will
> hide the first 128 GiB and expose the rest of the disk.
..

Yeah.. what's this "hpa swap" ?  Possibly a vendor-specific op, perhaps?

Cheers

Re: hdparm-9.2 now available: w/ DCO and firmware support

[Greg Freemyer]

On Tue, Nov 4, 2008 at 2:13 PM, Mark Lord <liml@rtr.ca> wrote:
> Greg Freemyer wrote:
>>
>> On Tue, Nov 4, 2008 at 1:08 PM, Mark Lord <liml@rtr.ca> wrote:
>
> ..
>>>
>>> Mmm.. never thought about that much before now,
>>> but DCO is a nifty way to hide much of a drive from prying eyes.
>>> Eg. Use DCO to restrict the drive to LBA28 accessible sectors
>>> and also turn off LBA48 support, and then a lot of space becomes
>>> "hidden".
>>> Until now!
>>
>> Yeah, combine that with some HPA shenanigans and you can create two
>> complete disk partition layouts on one drive.
>>
>> ie. Two partition tables, the normal partition table for the first 128
>> GiB is in sector 1.  The partition table for the rest of the disk is
>> at sector 128 GiB + 1.  Then use DCO to totally hide the upper section
>> of the drive.
>>
>> When you want access, use DCO commands to expose it, and then HPA
>> commands to make only the sectors beyond 128 GiB accessible.
>
> ..
>
> Now that one has me stumped.  The only HPA commands I know of,
> permit setting only the maximum-LBA, not the minimum.
> Or is this a newish ATA9 (or last-minute ATA8) sort of thing ?
> ..
>>
>> to the end of the disk, then issue a "hpa swap" command.  That will
>> hide the first 128 GiB and expose the rest of the disk.
>
> ..
>
> Yeah.. what's this "hpa swap" ?  Possibly a vendor-specific op, perhaps?
>
> Cheers
>
Mark,

I don't know the details, but I have a DOS program called "setoff"
that is about 10 years old that I have tested on at least a couple
LBA-28 drives and it works.  I doubt it works on LBA-48, but who
knows.

More comments after the readme quote

>>  From the Readme
=========================================

SETOFF - This program will offset the numbering of sectors in the drive to a new
starting sector, the location of the new starting sector is the
starting sector of an existing HPA. Basically SETOFF will tell the
drive that has a HPA on it to make the HPA visible as the normal drive
area and place the normal drive area as a HPA. It switches the HPA and
normal drive area with each other.

Example of SETOFF use;

SETOFF - Shows help screen

SETOFF 0 0 1 - This will engage sector off set on the Master drive on
the Primary IDE port

For example, say you have a drive with 12,000,000 (6Gbytes) sectors.
You have a HPA that starts at sector 8,000,000. This would give you a
drive that has 4Gbytes of user space and a HPA of 2Gbytes. Your
computer would only see a 4Gbyte drive when it boots up. Remember the
HPA is not seen by the computer normally. You could then use SETOFF to
make the 2Gbyte HPA the user space and the 4 Gbyte user space would
become the HPA. Great way to hide stuff isn't it.
---
Ok that's it. Any questions call or email me.
I have a Power Point that covers all of this rather well for classes
and an exercise to use as well.

MarkMenz@usa.net  or (916) 983-0348

===========
Mark Menz used to make his software available under restricted
circumstances.  I don't remember what the restrictions are.  Possibly
he just charged for them.  Or they may have been Law Enforcement only.

If you want to talk to him and the above contact info is bad, I'm sure
we can find him for you.  I believe his more recent products
(hardware) are described at www.MyKeyTech.com

HTH
Greg
-- 
Greg Freemyer
Litigation Triage Solutions Specialist
http://www.linkedin.com/in/gregfreemyer
First 99 Days Litigation White Paper -
http://www.norcrossgroup.com/forms/whitepapers/99%20Days%20whitepaper.pdf

The Norcross Group
The Intersection of Evidence & Technology
http://www.norcrossgroup.com

Re: hdparm-9.2 now available: w/ DCO and firmware support

[Greg Freemyer]

On Tue, Nov 4, 2008 at 4:04 PM, Greg Freemyer <greg.freemyer@gmail.com> wrote:
> On Tue, Nov 4, 2008 at 2:13 PM, Mark Lord <liml@rtr.ca> wrote:
>> Greg Freemyer wrote:
>>>
>>> On Tue, Nov 4, 2008 at 1:08 PM, Mark Lord <liml@rtr.ca> wrote:
>>
>> ..
>>>>
>>>> Mmm.. never thought about that much before now,
>>>> but DCO is a nifty way to hide much of a drive from prying eyes.
>>>> Eg. Use DCO to restrict the drive to LBA28 accessible sectors
>>>> and also turn off LBA48 support, and then a lot of space becomes
>>>> "hidden".
>>>> Until now!
>>>
>>> Yeah, combine that with some HPA shenanigans and you can create two
>>> complete disk partition layouts on one drive.
>>>
>>> ie. Two partition tables, the normal partition table for the first 128
>>> GiB is in sector 1.  The partition table for the rest of the disk is
>>> at sector 128 GiB + 1.  Then use DCO to totally hide the upper section
>>> of the drive.
>>>
>>> When you want access, use DCO commands to expose it, and then HPA
>>> commands to make only the sectors beyond 128 GiB accessible.
>>
>> ..
>>
>> Now that one has me stumped.  The only HPA commands I know of,
>> permit setting only the maximum-LBA, not the minimum.
>> Or is this a newish ATA9 (or last-minute ATA8) sort of thing ?
>> ..
>>>
>>> to the end of the disk, then issue a "hpa swap" command.  That will
>>> hide the first 128 GiB and expose the rest of the disk.
>>
>> ..
>>
>> Yeah.. what's this "hpa swap" ?  Possibly a vendor-specific op, perhaps?
>>
>> Cheers
>>
> Mark,
>
> I don't know the details,

<snip>

I got curious.  It is in a 7 or 8 year old spec.

T13
1407DT

>From Draft 5:  (http://www.t13.org/Documents/UploadedDocuments/project/d1407r5-Address-Offset.doc)

3.	Address Offset Mode operation

3.1	Enable/Disable Address Offset Mode

In devices that support the Address Offset feature, the SET FEATURES
subcommand 09h Enable Address Offset Mode, offsets address Cylinder 0,
Head 0, Sector 1, LBA 0, to the start of the non-volatile protected
area established using the SET MAX ADDRESS Command.

The Address Offset condition is cleared by the SET FEATURES subcommand
89h Disable Address Offset Mode,  a hardware reset or a power-on
reset.

If Reverting to Power on Defaults has been enabled by a SET FEATURES
command, it is cleared by software reset as well.

Upon entering the Address Offset mode the capacity of the drive
returned in the Identify device data is the size of the former
protected area. A subsequent SET MAX ADDRESS command using the address
returned by the  READ NATIVE MAX ADDRESS command allows access to the
entire drive. Addresses wrap so the entire drive remains addressable
(see figure 1).

If a non-volatile reserved area has not been established before the
device receives a SET FEATURES Enable Address Offset Mode command, the
command fails with Abort error status.

The Disable Address Offset Mode removes the address offset and sets
the size of the drive reported by the IDENTIFY DEVICE command back to
the size specified in the last non-volatile SET MAX ADDRESS command.

3.2	IDENTIFY DEVICE

IDENTIFY DEVICE word 83 bit 07, if set to one, indicates the device
supports the Address Offset Mode. IDENTIFY DEVICE word 86 bit 07, if
set to one, indicates the device is in Address Offset Mode.

3.3	SET MAX ADDRESS

Issuing the SET MAX ADDRESS command with bit 0 in the Sector Count
register set to one is not valid when the device is in Address Offset
Mode.

HTH
Greg
-- 
Greg Freemyer
Litigation Triage Solutions Specialist
http://www.linkedin.com/in/gregfreemyer
First 99 Days Litigation White Paper -
http://www.norcrossgroup.com/forms/whitepapers/99%20Days%20whitepaper.pdf

The Norcross Group
The Intersection of Evidence & Technology
http://www.norcrossgroup.com

Re: hdparm-9.2 now available: w/ DCO and firmware support

[Mark Lord]

Greg Freemyer wrote:
>..
> I got curious.  It is in a 7 or 8 year old spec.
> 
> T13
> 1407DT
> 
>>From Draft 5:  (http://www.t13.org/Documents/UploadedDocuments/project/d1407r5-Address-Offset.doc)
> 
> 3.	Address Offset Mode operation
..

Ahh.. yes.  hdparm reports this from the IDENTIFY data (-I),
but I haven't had a drive that supports it since, well, a long time ago.

Thanks!

hdparm-9.3 now available: --idle-immediate & --idle-unload flags

[Mark Lord]

hdparm v9.3 is now available from sourceforge. 

    http://sourceforge.net/projects/hdparm/ 

New since v9.2 are:

   --idle-immediate flag, to issue ATA IDLE_IMMEDIATE power-saving command
   --idle-unload flag, to issue ATA IDLE_IMMEDIATE with head unload/park.

Cheers