ATA Secure Erase

 
 

This procedure describes how to use the hdparm command to issue a Secure Erase ATA instruction to a target storage device. When a Secure Erase is issued against a SSD drive all its cells will be marked as empty, restoring it to factory default write performance.

DISCLAIMER: This will erase all your data, and will not be recoverable by even data recovery services.

DISCLAIMER: If you hit kernel or firmware bugs (which are plenty with not widely-tested features such as ATA Secure Erase) this procedure might render the drive unusable or crash the computer it's running on.

DISCLAIMER: The security-erase command is a single command which typically takes minutes or hours to complete, whereas most ATA commands take milliseconds, or seconds to complete. Whilst drives directly attached to a straight-forward SATA controller should work reliably, some "intelligent" interfaces such as USB or firewire to PATA/SATA bridges, SAS controllers or hardware RAID controllers may try to reset devices which they have decided are no longer responding. They may also decide that locked devices are faulty, and hence not provide any access to them in order to issue unlock commands. Such devices may still be unlocked by connecting them directly to a different SATA interface. Additionally, hdparm versions prior to 9.31 do not pass-through the long command time-outs required for the erase commands to the SCSI-ATA Command Translation ("SAT") layer which such devices use. Do not use versions of hdparm prior to 9.31 with such interfaces.

WARNING: Do not attempt to do this through a USB interface! This procedure worked fine when I tried it on my X-25M through the SATA interface. When I tried it again later on the same drive through a USB adapter, it let me password protect the drive, but would not accept the SECURITY-ERASE command. I shut down the system, reconnected the drive to the SATA controller, and found that the drive was bricked - BIOS couldn't recognize it. I will update this warning if I find a way to un-brick the drive. (I've had a similar experience - managed to lock myself out of three drives. Read this experience and learn from it - Chris)

WARNING: If the SECURITY ERASE fails, use --disable-security to set your drive back to normal. Do not set the password to an empty string or NULL. The Lenovo BIOS at least will not allow you to change the password if it's blank. It also freezes the drive so that you can't change the password later, after booting into an OS. I'm now stuck with three drives that are passworded and I cannot unpassword. I finally found a board with a Phoenix TrustedCore BIOS which does allow clearing an empty password - Chris.

Note: My hdparm program has an option --security-disable PWD. - Z

To successfully issue an ATA Security Erase command you need to first set a user password. This step is omitted from almost all other sources which describe how to secure erase with hdparm.

The example output shown is from an INTEL X25-M G1 80GB SSD running 8820 firmware. It was run from an Ubuntu 9.04 32-bit (Jaunty) Live CD booted from a USB flash drive.

Contents

[show

Step 1 - Make sure the drive Security is not frozen:

Issue the following command, where "X" matches your device (eg. sda).

hdparm -I /dev/X

Step 1a - Ensure the drive is not frozen:

Security:
Master password revision code = 65534
supported
not enabled
not locked
not frozen
not expired: security count
supported: enhanced erase
2min for SECURITY ERASE UNIT. 2min for ENHANCED SECURITY ERASE UNIT.

If the command output shows "frozen" (instead of "not frozen") then you cannot continue to the next step.

Many BIOSes will protect your drives if you have a password set (security enabled) by issuing a SECURITY FREEZE command before booting an operating system. If your drive is frozen, and it has a password enabled, try removing the password using the BIOS and powering down the system to see if that disables the freeze. Otherwise you may need to use a different motherboard (with a different BIOS).

A possible solution for SATA drives is hot-(re)plug the data cable (this might crash your kernel). If hot-(re)pluging the SATA data cable crashes the kernel try letting the operating system fully boot up, then quickly hot-(re)plug both the SATA power and data cables.

  • It has been reported that hooking up the drive to an eSATA SIIG ExpressCard/54 with an eSATA enclosure will leave the drive security state to "not frozen".
  • Placing my system into "sleep" (suspend to RAM) worked too---and this may reset other drives to "not frozen" as well. This has worked on PCs from various manufacturers including Dell, Lenovo, and Clevo. Many Live distributions can be suspended to RAM for this purpose:
 echo -n mem > /sys/power/state
  • Users have also reported that IDE Drives may be unfreezed by plugging in an IDE cable to a CD-ROM first, booting your system and then moving the IDE cable to the drive in question. This will allow you to bypass "SECURITY FREEZE" commands sent by BIOS and your OS. BE AWARE, that IDE cables are not hot-pluggable and this technique possesses even higher risks; under no circumstances should you connect/disconnect/swap power cables of an HDD or CD-ROM, when your PC is on.

Step 2 - Enable security by setting a user password:

WARNING: When the user password is set the drive will be locked after next power cycle (the drive will deny normal access until unlocked with the correct password).

Step 2a - Set a User Password:

Any password will do, as this should only be temporary. After the secure erase the password will be set back to NULL. For this procedure we'll use the password "Eins".

hdparm --user-master u --security-set-pass Eins /dev/X

Step 2a - Command Output:

security_password="Eins"

/dev/sdd:
Issuing SECURITY_SET_PASS command, password="Eins", user=user, mode=high

Step 2b - Make sure it succeeded, execute:

hdparm -I /dev/X

Step 2b - Command Output (should display "enabled"):

Security:
Master password revision code = 65534
supported
enabled
not locked
not frozen
not expired: security count
supported: enhanced erase
Security level high
2min for SECURITY ERASE UNIT. 2min for ENHANCED SECURITY ERASE UNIT.

Step 3 - Issue the ATA Secure Erase command:

time hdparm --user-master u --security-erase Eins /dev/X

Step 3 Command Output:

Wait until the command completes. This example output shows it took about 40 seconds for an Intel X25-M 80GB SSD, for a 1TB hard disk it might take 3 hours or more!

security_password="Eins"

/dev/sdd:
Issuing SECURITY_ERASE command, password="Eins", user=user
0.000u 0.000s 0:39.71 0.0% 0+0k 0+0io 0pf+0w

Step 4 - The drive is now erased! Verify security is disabled:

After a successful erasure the drive security should automatically be set to disabled (thus no longer requiring a password for access). Verify this by running the following command:

hdparm -I /dev/X

Step 4 - Command Output (should display "not enabled"):

Security:
Master password revision code = 65534
supported
not enabled
not locked
not frozen
not expired: security count
supported: enhanced erase
2min for SECURITY ERASE UNIT. 2min for ENHANCED SECURITY ERASE UNIT.

Known issues:

Executing security erase without setting a password

Some variations of this are spread on various Internet sources. It does not work because security is "not enabled" (see hdparm output below).

WARNING: DO NOT DO THIS! The Lenovo BIOS at least doesn't allow you to change the password if it's empty, and also freezes the drive so it can't be unlocked later, so your drive could be password-locked forever! If you just want to remove the security lock on your drive without secure-erasing it, use --security-disable instead.

hdparm --user-master u --security-erase NULL /dev/X
security_password=""
/dev/sdd:
Issuing SECURITY_ERASE command, password="", user=user
ERASE_PREPARE: Input/output error

Even if you freeze or lock your drive by running the above command from a Lenovo laptop with a blank password, it is still possible to unfreeze and unlock it. First, plug the drive into a different computer. Second, perform a power cycle of the drive while you are booted into a drive utility (like Gparted). Third, issue the following command which should disable the security on the drive.

sudo hdparm --security-disable PWD

Error: 25

With some distributions setting a password does not work:

hdparm --user-master u --security-set-pass Eins /dev/X
/dev/sdd:
Issuing SECURITY_SET_PASS command, password="Eins", user=user, mode=high
Problem issuing security command: Inappropriate ioctl for device
Error: 25

Compiling the latest hdparm from http://sourceforge.net/projects/hdparm/ resolved this problem on CentOS 5 x86_64.

Command time-out during erase with larger drives

hdparm versions prior to version 9.31 hard-coded the time-out for the erase command to be 2 hours. If your drive requires longer than 2 hours to perform a security-erase, then it will be reset part-way through the erase command.

If your drive reports that it needs longer than 120 minutes to perform the security erase operation, then you should ensure that you are using version 9.31 or newer.

If such a time-out has occurred, the output of the "time" command above will be just slightly longer than 120 minutes, and the drive will not have erased correctly. The drive will be reset when the time-out occurs, and whilst this appeared to do no harm to a 1GB Seagate ES.2, it's probably not a very well tested part of the drive firmware and should be avoided. In the case of the Seagate, the password was still enabled after the partial-erase and subsequent time-out/reset.

Alternative ATA Secure Erase Tools

HDDErase

The freeware DOS tool can also perform a ATA Secure Erase, although controller support is spotty at best.

【转】ATA Secure Erase的更多相关文章

  1. secure erase 时必须umount

    不umont就进行secure erase,仍然会执行成功,但是ssd确没有被清0,使用hexdump可以验证. 但是secure erase 命令却返回成功,造成误解以为已经擦除成功. 所以,sec ...

  2. WA(Write Amplification)写入放大

    WA是闪存及SSD相关的一个极为重要的属性.由于闪存必须先擦除才能再写入的特性,在执行这些操作时,数据都会被移动超过1次.这些重复的操作不单会增加写入的数据量,还会减少闪存的寿命,更吃光闪存的可用带宽 ...

  3. 如何使用在三星840 SSD硬件加密下使用Bitlocker

    我的笔记本存放到比较重要的资料,需要加密,想到我的三星EVO 850 SSD支持三种加密模式,于是想使用全盘加密模式.但是找了半天没找到一点合适的中文资料,于是怒而翻译一下加密全盘加密的Bitlock ...

  4. 硬盘坏道检测工具对比(DiskGenius/HdTunePro/MHDD等)

    说到硬盘检测软件,大家肯定会想到MHDD,但是MHDD真的好用?反正我觉得太难用了,只能在DOS下运行,不能在Win系统下运行:最重要的是只支持IDE硬盘模式,现在的主板几乎全部默认都是AHCI模式, ...

  5. Serial attached SCSI

    http://en.wikipedia.org/wiki/Serial_attached_SCSI Serial attached SCSI From Wikipedia, the free ency ...

  6. 【转】花开正当时,十四款120/128GB SSD横向评测

    原文地址:http://www.expreview.com/19604-all.html SSD横评是最具消费指导意义的评测文章,也是各类热门SSD固态硬盘的决斗疆场.SSD评测在行业内已经有不少网站 ...

  7. Spectrum Scale

    高端存储:2016年为止,最新产品为DS8884.DS8886和DS8888. 闪存系统:2016年为止,最新产品,以FlashSystem 900为硬件基础,包装了FlashSystem V9000 ...

  8. [硬件知识]OP(Over-provisioning)预留空间

    SSD上的OP指的是用户不可操作的容量,大小为实际容量减去用户可用容量,OP区域一般被用于优化操作如:WL,GC和坏块映射等. OP一般分三层(见下图).第一层容量固定为SSD标称容量的7.37%,这 ...

  9. NVMe固态硬盘工具箱使用说明

    https://www.bilibili.com/read/cv562989/ 浦科特NVMe固态硬盘工具箱使用说明 数码 2018-6-7 687阅读7点赞3评论 浦科特已经推出针对NVMe固态硬盘 ...

随机推荐

  1. 201521123121 《Java程序设计》第11周学习总结

    1. 本周学习总结 1.1 以你喜欢的方式(思维导图或其他)归纳总结多线程相关内容. 进程:每个进程都有独立的代码和数据空间,进程间的切换会有较大的开销,一个进程包含1--n个线程. 线程:同一类线程 ...

  2. ROS学习记录(四)————怎样建立一个package包?

    功能包是什么? 英文表述package,我可没有在炫英文啊,我的英文很烂的,只是在提醒大家,在ROS系统中,这个词使用的频率非常之高,你必须记住它,要不就没法正确的看懂信息.言归正传,package是 ...

  3. Java通过链表实现队列

    class LinkedQueue<T> { /** * 队列大小,由构造函数初始化 */ private int maxSize; /** * 队头 */ private Node fr ...

  4. IIS部署新网站

    Windows Server使用IIS 6.0配置ASP动态Web网站 http://jingyan.baidu.com/article/c1a3101ee43ae9de656debb4.html h ...

  5. Linux下识别分区文件系统类型

    Linux下挂载文件系统有时候需要填写文件系统.但有的设备拿到手还不知道文件系统,这种情况,可以用 parted命令 # parted /dev/vda GNU Parted 3.2 Using /d ...

  6. Spring 级联属性

    Spring 级联属性是当两个bean 关联时  从一个bean 给 另一个bean 赋值 Application xml  配置如下 <bean id="ZhangSan" ...

  7. [原创]MinHook测试与分析(x64下 E9,EB,CALL指令测试,且逆推测试微软热补丁)

    依稀记得第一次接触Hook的概念是在周伟民先生的书中-><<多任务下的数据结构与算法>>,当时觉得Hook很奇妙,有机会要学习到,正好近段日子找来了MiniHook,就一 ...

  8. Nginx学习——Nginx基本配置

    1.Nginx的配置文件总览 Nginx配置文件详解 : http://www.cnblogs.com/hunttown/p/5759959.html nginx.conf 基本格式: worker_ ...

  9. 《深入理解Java虚拟机》读书笔记-垃圾收集器与内存分配策略

    在堆里存放着java世界中几乎所有的对象实例,垃圾收集器在对堆进行回收前需要知道哪些对象还存活,哪些对象已经死去.那怎么样去判断对象是否存活呢? 一.判断对象是否存活算法 1.引用计数法 实现思路:给 ...

  10. poj2155一个二维树状数组

                                                                                                         ...