How do I enable a self-encrypting drive (SED) on Windows 7?

[Icthus_Tech]

How quickly things change.  Crucial has a utility to work with their SSDs, now.  You can download it from them here:

http://www.crucial.com/usa/en/support-storage-executive

This will allow anyone to perform a revert on encrypted Crucial drives.

As to the issue with masl_wm, I hope that HP can shed some light on this one.  Are the laptops covered under warranty and you can call for warranty support?

You might try going to http://www.r0m30.com/msed/files and downloading MSED.  Then follow the directions here to query the drives to find out the state of the drives.  You must first perform an "msed --scan".  This will reveal the physical drive number.  You will get a response from MSED looking someting like this:

Scanning for Opal compliant disks
\\.\PhysicalDrive0  2  Crucial_CT120M500SSD3                    MU05

No more disks present ending scan

You must then preform an "msed --query \\.\PhysicalDrive0" based on our example above.  You should replace PhysicalDrive0 with the drive you are seeing in the scan result for your Crucual M500 drive.  It will probably be PhysicalDrive0.  

If I had to guess, I would say that the drive somehow has flags set showing it is already locked (managed by another program, even though it isn't).  You can test to see the difference between a drive that is good and bad by turning OFF DriveLock on one of the laptops where it is working.  Then perform the MSED commands to scan and query on the good drive and compare to one on a laptop giving the issue.  Let us know the results of that as well.

The results may be enough to help you understand what is going on.  If you post the results of the Query here, I will try to help and perhaps Soccer_Dan can help as well.

Cheers!

[Icthus_Tech]

OK, so I said follow the examples of how to Query using MSED at a site, but never said where.  Here is the link to the site:

http://www.r0m30.com/msed/documentation/commands/examples

Sorry...

[Dennis_Handly]

>Some SED vendors make a utility to perform this operation and others do not.

I have since learned everything to you need to know about Opal 2.  🙂

>and it failed to revert a second drive. 

Wonder why?

[masl_wm]

I attached the msed query results. I also installed the Crucial Storage Executive but I couldnt find anything about locking state in there. Only the option for a PSID revert, but that would erase all data instead of just enable me to set a drivelock password through bios

[Icthus_Tech]

The attachment shows the following:

Locking function (0x0002)
Locked = N, LockingEnabled = Y, LockingSupported = Y, MBRDone = N, MBREnabled = N, MediaEncrypt = Y

I believe this is telling us the drive has somehow been set to have LockingEnabled, which is causing your problems.  It seems to be in a PARTIALLY OPAL managed state, which is why you are being told "HDD is HW encrypted".  Unfortunately, there is no password set or you don't know the password, so MSED cannot be used to change LockingEnabled to No.

Therefore, I can suggest two fixes.  The one I would try first is to use the Crucual PSID Revert utility.  Since nothing is on the drive yet, this should not be an issue as it will certainly destroy all data on the drive.  This may turn off the LockingEnabled flag and you will successfully be on your way.

If not, the second fix is to return the drives for warranty replacement.  Crucial has been VERY good to me with this in the past.  Please let us know how things turn out.

[masl_wm]

Hm the drive is not empty, the fresh installed Win7 is on it.

Maybe I can do a fullbackup using Acronis for example, then do the revert and then restore the backup?!

[Icthus_Tech]

In this case, yes, you can copy the image to a backup drive using Acronis, PSID Revert the Crucial SSD, and then copy the image back again.  Copying the image should NOT preserve the LockingEnabled flag, so if the Revert clears that flag, it should be cleared for good.  After this, please run MSED *BEFORE* you try to turn on DriveLock and capture the Query results.  We want to be sure the LockingEnabled flag is No.  After that, you can try to turn on DriveLock again and see if it works or if it fails.  Either way, after attempting to set the DriveLock password, would you please run MSED again and post the Query response?  I'd like to see if DriveLock is locking down the system with the ATA Password lock or if it is actually managing the Self-Encrypting drive feature.

[masl_wm]

Ok, tried the msed command on a working laptop, this is the output, slightly different ...

Can I perform a PSID revert directly through the storage executive from crucial? There is only one disk in the laptop and Win7 is running on this Crucial disk.

[Icthus_Tech]

Yes!  We have found the problem!  The good drive shows this:

The bad drive shows:

The difference is that the LockingEnabled flag is set to Yes on the bad drive, which indicates the drive is being OPAL managed.  That is why the laptop BIOS tells you the SSD is hardware encrypted.

I have never performed the revert using the Crucial utility, but I believe  you are correct.  You will need to have the Crucial utility installed on a separate PC and have the bad drive attached as a secondary drive.  Run the Revert on the secondary drive and then see if the flag is reset.

[Dennis_Handly]

>I believe this is telling us the drive has somehow been set to have LockingEnabled, which is causing your problems.

It means that the Locking SP has been activated.  And usually that means ownership has been taken.

For SSC Enterprise, this should always be set when you first get it, so not meaningful there.

Here is what I get on my SSC Opal SED after a revert:

tper features:      0x11
        SyncSupported StreamingSupported
locking features:   0x09
        MediaEncryption LockingSupported   <<<
Geometry feature:
        ALIGN:   1
        LBS:     512
        Align_G: 8
        LALBA:   0
Opal SSC features:
        Base ComID:          0x7ffe
        Number of ComIDs:    1
        no range crossing:   0
 Single User Mode features:
        lock objects:        9
        policy:              1 <<<  (Not SUM)
        all:                 0   <<<  (Mine is off)
        any:                 0
 DataStore Table features:
        max datastores:      9
        max size datastores: 10485760
        datastores align:    1
 Opal SSC V2.00 features:
        Num Lock_SP admin:   4
        Num Lock_SP user:    9
        C_PIN SID_init:      0
        C_PIN SID_revert:    0

Here is a SSC Enterprise:

Vendor features LC: 0x80
   supported:       0x5f
        Multibands UDS_control Diagnostics_access FW_download_access Locking Full_disk_encryption
   enabled:         0x19
        UDS_control Diagnostics_access Full_disk_encryption
tper features:      0x11
        SyncSupported StreamingSupported
locking features:   0x0b
        MediaEncryption LockingEnabled LockingSupported (Locking SP is there)
SSC features:       0x07fe0002
        Base ComID:       0x07fe
        Number of ComIDs: 2

>It seems to be in a PARTIALLY OPAL managed state, which is why you are being told "HDD is HW encrypted".

Yes.  I had one range set before the revert and that had LockingEnabled = Y and after it's gone.

>there is no password set or you don't know the password, so MSED cannot be used to change LockingEnabled to No.

If there is no password, it should be able to authenticate.

>This may turn off the LockingEnabled flag

> Run the Revert on the secondary drive and then see if the flag is reset.

No need to "see", it looks like this is mandatory from the specs.

Unless the Locking SP is activated during manufacturing and then the flag doesn't mean much.