Bad actors and rootkits can hide malicious code, stolen files, or illicit data inside an HPA.
What (e.g., standard Windows, WinPE) you plan to run this tool from?
Using ATATool carries significant risks, as it can result in if used incorrectly.
/NONVOLATILEHPA : Instructs the disk controller that HPA changes must persist permanently through system reboots and total power downs. Without this flag, configurations revert during power loss.
The core of the Atatool is its lithium battery, which offers a superior power-to-weight ratio compared to lead-acid alternatives. These batteries provide longer lifecycles, ensuring you can use the station for hundreds of cycles without significant capacity loss. 2. Multi-Port Output atatool portable
Atatool makes it easy to keep the power flowing, offering three main charging methods:
When deployed inside a Windows command terminal, ATATool follows a predictable argument hierarchy. The base syntax structures include: Command Argument Technical Purpose Target Output ATATOOL /LIST
| Command (Example) | Action | Result | | :--- | :--- | :--- | | ATATOOL /LIST | Detection | Lists all physical drives connected to the ATA controller. | | ATATOOL /INFO \\.\PhysicalDrive1 | Inspection | Displays comprehensive data about the drive, clearly indicating if an HPA or DCO is active. | | ATATOOL /SETHPA:50GB \\.\PhysicalDrive1 | Create Temporary HPA | Sets the drive's maximum accessible capacity to 50GB, hiding the remainder. This change is lost upon a power cycle. | | ATATOOL /NONVOLATILEHPA /SETHPA:50GB \\.\PhysicalDrive1 | Create Permanent HPA | Does the same as above, but the hidden area remains hidden even after power cycles or reboots. | | ATATOOL /NONVOLATILEHPA /RESETHPA \\.\PhysicalDrive1 | Remove HPA | Restores the drive to its full, true capacity, removing any active Host Protected Area. This is the most common use of the tool. | | ATATOOL /SETDCO:100GB \\.\PhysicalDrive1 | Set DCO | Configures the DCO to make the drive report a maximum addressable capacity of 100GB to the BIOS and OS. This is a permanent setting. | | ATATOOL /RESTOREDCO \\.\PhysicalDrive1 | Restore DCO | Removes the DCO, restoring the drive's native default parameters. | | ATATOOL /BADECC:5 \\.\PhysicalDrive1 | Simulate Bad Sector | Corrupts the ECC data for sector 5, causing it to appear as a 'bad' sector. |
Whether your primary goal is or hardware quality testing . Bad actors and rootkits can hide malicious code,
The portable nature of such a tool is essential for its primary users: Forensic Integrity
It is important to note that ATATool is no longer available for general public download. Due to its "dangerous" potential—the ability to permanently damage hardware or destroy data if used incorrectly—it is restricted to "professional users," such as law enforcement and authorized security researchers. This gatekeeping ensures that a tool capable of altering a hard drive's fundamental configuration remains in the hands of those who understand the risks of sector-by-sector manipulation.
Because it operates as a standalone executable that does not require a formal Windows installation sequence, it is frequently utilized as a "portable" tool carried on technician triage drives, forensic USB kits, and Windows Preinstallation Environments (Windows PE). What is ATATool Portable?
Fully unmasks hidden drive capabilities or hidden native storage blocks. Access and Availability Constraints /NONVOLATILEHPA : Instructs the disk controller that HPA
Personal requests, anonymous requests, and those from disposable email addresses are ignored by the developer. While the tool is still maintained and can be requested for legitimate professional use, it is effectively inaccessible to the average user.
: Investigators use it to ensure their hardware and software imaging tools can correctly detect and handle drives with restricted capacities.
A detailed 6-page manual often cited in technical and forensic circles for command-line syntax and usage examples. Data Synergy UK Ltd Context for Researchers
For security researchers and quality control engineers, ATATool Portable can actively corrupt a disk's Error Correction Code (ECC) data. This simulates realistic "bad sectors" on spare hard drives, allowing labs to test compliance workflows and ensure their primary triage systems successfully flag physical drive defects. 4. Advanced Protocol Support