hdparm: what does --dco-restore really do?

Question

I am following instructions on this other SuperUser post: Harddrive - wipe out "hidden areas" like HPA and DCO also after malware infection

For the last few days I have been researching hidden areas of a HDD and have been experimenting with them in Linux. Two topics which peaked my interest were the Host Protected Area and the Device Configuration Overlay. I managed to scan my HDD for the HPA and found that the HPA is disabled, meaning it doesn't have one.

As for the DCO, I executed:

sudo hdparm --dco-identify /dev/sdb

And got the following output:

/dev/sdb:
DCO Checksum verified.
DCO Revision: 0x0002
The following features can be selectively disabled via DCO:
Transfer modes:
mdma0 mdma1 mdma2
udma0 udma1 udma2 udma3 udma4 udma5
Real max sectors: 1465149168
ATA command/feature sets:
SMART self_test error_log security HPA 48_bit
selective_test
WRITE_UNC_EXT
SATA command/feature sets:
NCQ interface_power_management SSP

My questions are:

1. What does that mean?
2. What exactly is a DCO? Should I get rid of it by executing --dco-restore?
3. Can malware reside in the DCO?
4. Is there a disadvantage to removing the DCO? I'm not sure if this will affect my ability to install an OS onto the HDD later.

I want to ensure malware cannot hide in hidden HDD areas and am concerned as to whether there is any personal data residing there.

Though I do not want to risk bricking my HDD.

Answer 1

As explained in the DCO (device configuration overlay) entry on Wikipedia:

The Device Configuration Overlay (DCO), which was first introduced in the ATA-6 standard, "allows system vendors to purchase HDDs from different manufacturers with potentially different sizes, and then configure all HDDs to have the same number of sectors. An example of this would be using DCO to make an 80-gigabyte HDD appear as a 60-gigabyte HDD to both the (OS) and the BIOS.... Given the potential to place data in these hidden areas, this is an area of concern for computer forensics investigators. An additional issue for forensic investigators is imaging the HDD that has the HPA and/or DCO on it. While certain vendors claim that their tools are able to both properly detect and image the HPA, they are either silent on the handling of the DCO or indicate that this is beyond the capabilities of their tool."