I feel linux is better, while working on HPA/DCO I realized that. Just that linux has some built in features that will detect HPA. Also, there is an intersting case: if you create HPA on the disk such that the size is in KB , then some versions of windows won't detect, even if it does the size will 0MB and the tools that can run on windows might not detect that there is a HDD. While on Linux platform, although the size will shown as 0, but TSK can easily detect and reset the HPA, Also once the investigator finds out that there is HPA on the disk then he can easily reset it back.

So the idea here is to find out whether there is any HPA or not.

MRG.