Atola Technology

HDD Security System

BIOS password was the first method widely used to protect the computer from unsolicited use. The idea was that your computer won’t boot until the correct password entered.

This type of protection was rather weak and was primarily intended to protect from intruders who have no access to the hardware itself. To bypass such protection, one could take the drive off the computer, attach it to another computer and all the data can be copied.

At that time, to protect the data on the drive, one had to create additional layers of security by using special software for data encryption.

The idea to protect data by setting the password not only to the BIOS but to the drive itself was proposed a decade ago, but only now the technology has spread enough to be widely used.
Nowadays all modern notebook computers set a password to the drive simultaneously with setting it to the BIOS. That is why it is important to understand how the disk drive security works.

HDD Passwords

The possibility to restrict access to the data exists on almost all modern drives. This restriction is implemented by the security system of the drive itself. Thus, it makes the attachment of the drive to another computer meaningless as the password is physically stored on the drive.

Every drive which supports security features can contain simultaneously two passwords: User and Master.

User Password

User Password is the password that you use to restrict the access to the data on the drive. When User password is set the drive becomes Locked. When the drive is locked, no data can be read or written to it.

So the drive is locked when, and only when the User password is set.

When locking the drive (i.e. setting User password), you can choose how the drive can be unlocked. Either only User password can unlock the drive or both User and Master passwords can be used. This is done by setting Security level flag. This flag can be modified only while setting User password. Security level can be either ‘High’ or ‘Maximum’.

Master Password

Master password is intended to be used in case User password is lost or forgotten.

Every hard drive has some predefined Master password set. Unfortunately it is not standardized. Usually it contains just 32 spaces, but it may vary depending on the hard drive manufacturer and model number. Master password can be easily changed if the hard drive is not in the locked state.

The capability of Master password (what you can do with it) depends on Security level flag which is set during locking the drive (as described in the previous section):

  • If the Security level is ‘High’, Master password can be used in place of User password.
  • If Security level is ‘Maximum’, the drive can be unlocked using Master password only with the erasing of all data on the drive.

By the way, the term “Security Level” will be substituted in the future versions of ATA Standards by the better one: “Master Password Capability”.

Back to BIOS

So, when you set a password on a notebook computer, BIOS will do the following:
• Store the password in the BIOS itself.
• Change Master Password of the HDD to protect the user from using manufacturer’s default.
• Change User Password of the HDD. This operation will lock the drive.

Atola Insight Forensic - All-in-on forensic data recovery tool. In-depth disk diagnostics, disk duplication and wiping, firmware and file recovery.
5 Comments

So when the password is lost, there is no way to unlock the hard drive?

Comment by Peter on May 27, 2010 3:38 pm

In reality all drives can be unlocked without correct known password – because password is stored in the HDD’s firmware.

There is a plenty of specialized tools on the internet for HDD unlocking. They all work using vendor specific commands to access firmware and to extract password from HDD.

So HDD security system is a very weak protection mostly.

Comment by Fedir Nepyivoda on June 1, 2010 11:10 am

From where do you have the information that the password is stored somewhere on the drive (e.g controller chip).

If you are right, then if someone use ATA security commands to encrypt (not only to protect!!!) the drive (e.g. Seagate Full Disk Encryption), the encrpytion is useless if the vendor could “recover” the key (used password).
Or do you mean that the vendor could remove (not recover the password) the password request only for protected (not encrypted) drives?
If the vendor could only remove the password request then a encrypted drive is still encrypted and useless.
Do you have a good and reliable source for this information?

Comment by Manuel on January 25, 2011 12:47 pm

>>They all work using vendor specific commands to access firmware and to extract password from HDD.
+maybe vendor specific commands to access crypted data(when ejected), or even auto uncript – by [hidden]saved early key or bruteforce (+if key algo – bad, like in BIOS)
>>So HDD(and all HW protection) security system is a very weak protection mostly.
Who make HW – that (potentionally,but…)always have backdoor, minimum becouse that info – $$$.

Comment by uuu on June 10, 2011 3:58 pm

I have a DVR with a Western Digital hard drive where the vendor locked the drive with a password to prevent people copying off the data. I would dearly like to be able to unlock it so I can copy off the data and upgrade the drive.
My research suggests that the password cannot be accessed without using specialist software or talking to the drive’s manufacturer as they have unlock tools – sometimes the passwords are stored on the disk which you can’t access without unlocking the drive.

Comment by Paul M on September 22, 2014 11:56 am
Leave a comment