Locking an ATA drive

unlockata can be used to enable ATA Security and set a password on a drive with the -op set operation.

Caution

Be extremely careful when using -op set.

This operation enables ATA Security and configures the password provided in password.bin.

Make sure you have a backup of your data and keep the password somewhere safe before locking the drive.

If you lose the user password, you may need the drive's master password to recover access, depending on the drive's security configuration.

Do not test this on a drive containing important data unless you are absolutely certain you know how to unlock it.

You will need a password file with an exact size of 32 bytes.

If your password is an ASCII string shorter than 32 bytes, you can create the password file with dd.

For example, assuming the password is verysecret123:

printf 'verysecret123' | dd of=password.bin bs=32 count=1 conv=sync

dd will pad the remaining bytes with NUL (0x00) bytes, producing a file that is exactly 32 bytes long.

If you do not want to use a human-readable password, you can generate a password file containing 32 bytes of random data directly from /dev/urandom:

dd if=/dev/urandom of=password.bin bs=32 count=1

Note: Change password.bin to another filename if the file already exists.

Locate your ATA drive

First, list the available ATA drives:

yonle@yonle ~$ sudo unlockata -device list
/dev/sda: 51CBCxxxx [TOSHIBA MK5075GSX]
/dev/sdb: 202103040xxxx [MidasForce SSD 240GB]
yonle@yonle ~$

For this example, we will lock the MidasForce SSD 240GB.

You can identify the drive either by its serial number or by its block device.

Using the drive's serial number

sudo unlockata -serial 202103040xxxx -passwd password.bin -op set

Using the block device directly

sudo unlockata -device /dev/sdb -passwd password.bin -op set

If successful, unlockata should not report an error:

yonle@yonle ~$ sudo unlockata -serial 2021030400273 -passwd password.bin -op set
2021030400273 is at /dev/sdb
yonle@yonle ~$

The drive is now protected by ATA Security. After the drive is powered off or otherwise reset, it will require the configured password to become accessible again.

Verify the lock

After setting the password, you can power-cycle or otherwise reset the drive and then attempt to access it again.

The drive should report itself as ATA Security locked until it is successfully unlocked with the configured password.

To unlock it again:

sudo unlockata -serial 2021030400273 -passwd password.bin

If the password is correct, the drive should become accessible again.