part of the investigation process, and the National Institute of Standards and Technology (NIST) has conducted tests on common acquisition tools. The Computer Forensic Tool Testing (CFTT) project at NIST developed requirements and test cases for disk-imaging tools. The results and specifications can be found on their Web site (http://www.cftt.nist.gov/disk_imaging.htm). • BXDR – Many of the current acquisition tools on the market will detect an HPA, and there are also specialized tools such as BXDR (http://www.sandersonforensics.co.uk/BXDR.htm) by Paul Sanderson, • Diskstat – diskstat in The Sleuth Kit, DRIVEID by MyKey Technology (http://www.mykeytech.com), and hpa by Dan Mares (http://www.dmares.com/maresware/gk.htm#HPA). • ICS Image Masster Solo2 – The Image MASSter Solo 2 from ICS (http://www.icsforensic.com ) will copy the sectors hidden by a DCO • NoWrite – The Mykey Technology NoWrite™ SD is a hardware device that provides a write blocked SD and micro SD card reader for digital forensic review and media duplication – http://www.mykeytech.com/nowrite.html 13