Forensic laboratories can use ATATool to test their own procedures for detecting hidden HPA/DCO areas.
Unlike standard partition managers or diagnostic software that interface only with volumes exposed by the operating system, ATATool sends commands directly to the drive controller. This grants access to areas of a hard disk drive (HDD) or solid-state drive (SSD) that are normally invisible to both Windows and the end-user.
I can provide target-specific commands or technical workarounds based on your goals. Share public link
Despite its restricted availability, understanding the original tool's architecture is valuable. The core executable, ATATool.exe , weighed only a few hundred kilobytes. Because it was a single file, technicians could copy it to a USB flash drive and run it directly from Windows PE (Preinstallation Environment) or a command prompt without leaving any traces on the host computer. atatool portable
Scans and lists all directly connected PATA and SATA devices. Preliminary device identification. /INFO
The device supports pass-through charging, meaning users can charge the Atatool while simultaneously powering devices from it. Recharge times vary by model but typically range from 4 to 6 hours via AC wall outlet.
Personal requests, anonymous requests, and those from disposable email addresses are ignored by the developer. While the tool is still maintained and can be requested for legitimate professional use, it is effectively inaccessible to the average user. Forensic laboratories can use ATATool to test their
: Applying or removing a DCO fundamentally alters how the hardware reads sector footprints. If the drive contains an existing active file system, altering these hardware parameters risks corrupting file system boundaries. This technique should primarily be performed on empty baseline drives or drives destined for validation testing.
To run the utility portably, execute the binary from an . Note that ATATool requires a direct connection to a native PATA or SATA controller; it cannot pass low-level ATA commands through standard consumer USB-to-SATA bridge cables. Command Action Syntax Example List Connected Drives ATATOOL /LIST View HPA & DCO Status ATATOOL /INFO \\.\PhysicalDriveX Restrict Capacity via HPA ATATOOL /SETHPA10GB \\.\PhysicalDriveX Restrict Capacity via DCO ATATOOL /SETDCO10GB \\.\PhysicalDriveX Corrupt ECC (Simulate Bad Sector) ATATOOL /BADECC0 \\.\PhysicalDriveX
Queries drive limits, serial numbers, and hidden HPA/DCO statuses. Detects hidden storage variations. Configures an artificial upper boundary on drive storage. Simulates anti-forensic environments. ATATOOL /RESETDCO Because it was a single file, technicians could
It can purposefully corrupt an sector's Error Correction Code (ECC) data using the /BADECC or /VERIFY0 commands. This generates an authentic "bad sector" on a spare drive, allowing labs to stress-test their hardware write-blockers and imaging software. Feature Summary Table Command Protocol Primary Function Forensic/Security Use Case ATATOOL /LIST Maps out all directly attached physical ATA drives. Quick system inventory during triage. ATATOOL /INFO \\.\PhysicalDriveX
Do you need help writing a ?