Are 'locked' eide drives secure?

[pfp]

The ata-3 eide hard drive specification allows you to set a password without which the disk is unaccessable. Does anyone know how secure this is? Is it sufficient protection for a notebook computer containing confidential personal data about customers (e.g. regulated by the data protection act in the UK).<br>

 

[waynemaples]

Definitely a value judgement unless there are documented attacks. There is normal and maximum security settings. In normal security setting, the drive master password set in the factory can be used to unlock the<br>
user password. In max security mode, the drive master password can be used to erase the drive but not reset<br>
the user password.<br>
<br>
There is also a lock, unlocked and frozen mode. See ATA-3 standard.<br>
<br>
The obvious question is, can a data recovery company read the security data?

 

[pfp]

Looking at the ata-3 spec there seems to be two obvious weaknesses:<br>
1. The security word of the BIOS is reaad-write and bit 1 indicates whether security is enabled - I suspect this could be changed with debug.<br>
2. There is a bios command to reset the drive to 'factory defaults' which is executable even when the drive is locked, the bad news is that the default is security off.<br>
<br>
Still, this is only theroretical and is probably dependant upon vendor implementation as these are 'optional' features of ata-3. What I'm really interested in is any real world expereience as to what level of assurance is given. Its notable that the drive manufacturers are strangely silent on this.<br>

 

[waynemaples]

thats what I found when I started searching. No reports of real-world attacks and no info except<br>
press stuff from manufacturers.