Momentus XT, Momentus, Momentus Thin, MobileMax, and other notebook drives

[Stephan]

Hi,

I'm using a Seagate Momentus FDE.2 hard drive and just wanted to make sure I am using it in the right way and that my stuff is actually encrypted

I got the drive, didn't set a password, connected it to a USB adapter, ran software to clone Windows / files / stuff on to it,

next I plugged it in to the laptop as the main drive, then set the hard disc password through the laptop's BIOS screen.


Is that it? I don't have to set the password first do I? Because if so, perhaps I'm not protected after all....

From what I've read, it sounds like the drive is constantly encrypted no matter what, but the password is what enables/disables access to the encryption/decryption chips, basically. I only have a vague understanding of how it works at the moment, can someone update me please, or send me a link to a place that explains it?

Thanks

[Justy34]

Far as I know bio's does encrypt nothing. It just keeps other users on the computer from accessing your hard drive. But if you were to plug that hard drive into another computer. My guess you would read it just fine. Most hard drives that have a encryption (from what I've seen anyways) comes with a program to encrypt the hard drive. When it is done, you can plug it into another computer and you can't see whats on that hard drive without a password.

[Stephan]

Hi,

I think you are right generally speaking, but the Seagate Momentus FDE.2 (the FDE stands for Full Disk Encryption) uses AES encryption on-the-fly without software, so might be a bit different from the normal BIOS hard drive password protection.

I think I'm doing it right, but wouldn't mind someone from Seagate to confirm that I am, as I have about 150-200 laptops to clone this way!

[Stephan]

Hi,

Sorry to be a pain, but can anyone confirm that what I wrote in the first post is correct please?

Maybe a moderator? Or I can contact support if that's easier.

[AlanM]

Hi Stephan:

Thanks for your participation in the our forums so far. Please remember that this is an online community where many of the responses come from other users, such as yourself. The forum is not a replacement for Customer Service. Seagate representative do from time to time come to lend a hand answering posts but not necessarily on a continual or frequent basis. If you have immediate needs, your best bet is to contact Customer Service directly whether by phone, email, or chat.
Thanks.

-AlanM
Moderator

[Stephan · Accepted solution]

Thanks. I got a reply through support. Here it is in case it's useful to anyone else:

(the first sentence sounds strange because I've copied and pasted out of context).

"The drive is encrypting all the time and he just needed to enable a method of controlling access. The ATA password in the BIOS is one method. There are stronger methods available from Wave and Secude which also provide utilities for erasing the encryption key and other benefits, but the ATA BIOS is acceptable to most users.

This is a good starting point for FDE questions.
http://www.seagate.com/ww/v/index.jsp?locale=en-US&name=dn_sec_tools_resources&vgnextoid=d29003b1268...

..... more information about Wave and Secude is available under the Security Partner Solutions link"

So you should be OK using the BIOS password but if you wanted stronger security solution you would want to investigate the Wave and Secude information under the Security Partner Solutions link.

[LyntonS-A]

If you are in a Corporate environment and have a farm of Momentus FDE and standard drive machines, then the only solution to manage them both is WinMagic.

Best regards,

Lynton

[Stephan]

Just to update this post which was written when I was researching full hard drive encryption for my company...

We went with Seagate Momentus FDE drives for all the computers that supported a SATA connection. (hundreds, at least 95%)

You don't need to use special management software for the drives. All you need to do is clone your existing user's hard drive to the new one (or start with a fresh image/installation), then set a master and user password in the BIOS menu. The user can set the user password, but the master password must remain secret (as it overrides the user one). Make sure it's not the actual BIOS boot password you are setting. There is a special area to set a hard drive password.

It is probably a good idea to make all the master passwords for each drive different and store them somewhere safe (if your company has a password safe, physical safe, etc, that's the kind of place). You can make them the same on all drives, but if someone from your IT department leaves and knows it, none of your data is safe.

Nowdays most companies are not using 100% Windows and the time for 100% Windows solutions being accepted is over. At my present company we have a mixture of Ubuntu, Debian and Windows users, so we were pleased to find the Seagate solution.

I haven't used WinMagic, but we used "Pointsec" for the computers that couldn't take the SATA hard drives. Most of these computers have now been replaced as software encryption is quite slow, especially if you have antivirus running on top. Plus the computers that don't support SATA and the Seagate drives are normally pretty slow anyway. To be honest, we didn't really get on with Pointsec. It was very hard to get hold of, not particularly easy to deploy and not exactly cheap. The hardware solution was around the same price but with no speed decrease.

So to summarise, we have the Seagate FDE drives installed on hundreds of computers, the passwords being securely stored. For the computers without SATA connectors, we used software encryption (Pointsec) and managed those separately.

[Tomek]

Great thread, very helpful. Can you, please, let me know what software you use to copy data from old drives to the new ones? We are in front of the same project. Thanks.

[Stephan]

Hi, yeah no problem, glad to help.

We used a mixture of methods, mainly a special hard drive cloning machine (about £600) which had a copy + copy/resize option. You just plugged in both drives and pressed the Start button.

In some offices abroad, we used a USB 2.0 hard drive adapter and bootable CD copying programs connected to a laptop. We used "Clonezilla" in some cases and "Copywipe" in others.  For some reason some software wouldn't copy drives where others would, it was a bit odd but in those cases we just used the other software (clonezilla instead of copywipe or vice versa), it wasn't worth our time looking into it. You could also use gparted, which has a function for copy+pasting partitions from one drive to another. Acronis maybe, Norton Ghost, dunno, but Clonezilla and Copywipe do the trick and are free.

 If you have hundreds of drives, the hard drive copying machine is worth it.

Also, during the cloning process make sure the FDE drive doesn't have a password set. Just clone the drive, then set the hard drive password in the BIOS and that's it. The best thing about this system is that you can dual boot and use any OS. Just be sure to set a (unique probably) master password and store it securely. If you only set a user password and the user forgets it, you've had it!

Good luck :-)