Hi,

I came accross this this post - Re: T480 Drive Encryption and posted a reply but no reply received.

So, I want to know the following:

1. How does the HDD Hardware Encryption works on a Lenovo T480, what I discovered it works a bit different, boot into the BIOS and enable the HDD Password, enter a password and that's it correct? Note * This is on a Intel SSDPEKKF512G8L SSD.

2. What I normally used is OPAL Encryption on the Samsung EVO 8xx range but I'm not able to do this on the T480 with the Intel SSD?

Did anybody else experienced this before and if so, please give me some feedback.

Thanks.

"Intel SSDPEKKF512G8L SSD" is a self-encrypting OPAL drive which means that the data stored on it is always encrypted.  If you want to secure the key that is used to perform the encryption, there are 2 ways to do it.  The easiest way is to set a HDD password in BIOS setup.  The other way is to use OPAL software such as sed-util or WinMagic SecureDoc.  

Hi,

Thanks for the reply and update.

So if I use Sed-Util I dont pickup and OPAL complient disks, unless I'm using a wrong version of the Sed-Util Software, I'm using this:

1. https://github.com/Drive-Trust-Alliance/sedutil/wiki/Encrypting-your-drive
2. https://github.com/Drive-Trust-Alliance/sedutil/wiki/Command-Syntax

I did go the BIOS HDD password route, but it seems so easy, if you can boot into the bios then you can change or remove the password, right?

WinMagic SecureDoc uses Bitlocker and that's software encryption and I want Hardware Encryption.

Thanks.

---

I did go the BIOS HDD password route, but it seems so easy, if you can boot into the bios then you can change or remove the password, right? 

You can only change/remove the HDD password if you know what the current password is.  Just booting into BIOS does not let you change or remove the HDD password.

---

 

 

WinMagic SecureDoc uses Bitlocker and that's software encryption and I want Hardware Encryption.

 

---

That's incorrect.  SecureDoc is capable to manage OPAL drives.  Most of our customers who require hardware encryption are using it.  McAfee and Symantec also have OPAL management software, but SecureDoc is the most popular one.

---

So if I use Sed-Util I dont pickup and OPAL complient disks, unless I'm using a wrong version of the Sed-Util Software, I'm using this:

1. https://github.com/Drive-Trust-Alliance/sedutil/wiki/Encrypting-your-drive
2. https://github.com/Drive-Trust-Alliance/sedutil/wiki/Command-Syntax

 

---

I didn't understand this question, but I'm not sed-util expert.  It would be better to ask sed-util forum about how to use sed-util to manage OPAL encryption.

You can only change/remove the HDD password if you know what the current password is.  Just booting into BIOS does not let you change or remove the HDD password.

Okay, great just checking on this. For extra security you can add a BIOS password as well.

 That's incorrect.  SecureDoc is capable to manage OPAL drives.  Most of our customers who require hardware encryption are using it.  McAfee and Symantec also have OPAL management software, but SecureDoc is the most popular one.

Where can I download the WinMagic / SecureDoc software to check it out and test it.

I didn't understand this question, but I'm not sed-util expert.  It would be better to ask sed-util forum about how to use sed-util to manage OPAL encryption.

I only send you the links to tell you that's what we use to do the OPAL incryption on Samsung SSD's. Sed-Util but the looks and what I've seen doesn't support the Intel SSD, but like you mentioned WinMagic / SecureDoc does

I'm not sure why sed-util wouldn't support the Intel drive.  OPAL is a specification and it's supposed to be implemented in a consistent way across drive models and manufacturers.  If you found some documentation that suggests that Intel doesn't work with sed-util, please send it to me and I can pass it along to Intel to get their comment about it.

You can request an evaluation version of WinMagic SecureDoc from their website:  https://www.winmagic.com/evaluation

I have physicallty done this with Sed-Util, and the result I go was it's not supporting the specific Intel SSDPEKKF512G8L but I will make a blog post and share it with you, the steps I followed with screenshots, if you like?

I requested a copy of the software and will check it out, it's obviously paid software where OPAL is free.

Screenshots and details would be great, thanks.

Yes, SecureDoc is commercial software.  OPAL is free and included on your drive, but SecureDoc manages the encryption (including remote deployment/administration, recovery, and end-of-life unprovisioning).  That is the value-add of SecureDoc.  If you just want encryption on a single PC, as I already told you, setting the HDD password is the easiest way to accomplish that.  If you want to manage encryption on a fleet of PCs, that's where SecureDoc is extremely valuable.