I've posted a question about securing data on a HDD, but I believe I won't get much answers, so I'm going on my own idea, that is to use ATA Security feature now present on most drives. My need is to prevent disk data to being accessed without proper credential in case the computer or the drive unit is stolen. I want something easy and transparent.
I plan to use a motherboard with a LGA 1155 (core i3/5/7 second generation), with a P67 chipset. I'm targeting Asus brand, possibly a P8P67 Pro or Deluxe with EFI. From the user manual online, I can see that they use the AMI BIOS/EFI 2.00 (10/07/2010). I see they provide support for the power on ("BIOS") passwords, but don't see a snapshot of activiting HDD passwords. I fear this is not supported by AMI.
- does AMI supports ATA Security in recent versions with EFI?
- in case this is not supported, is it possible to "extend" the BIOS/EFI for this feature?
- does someone own a new P67 motherboard and can confirm this support?
- which other BIOS or M/B models are known to support ATA Security.
To elaborate on ATA Security choice:
This is a password scheme supported totally by the HDD. Passwords are stored on the disk, not in BIOS. It is different from BIOS power on passwords (they may coexist on a system).
ATA Security requires the BIOS to submit a password to unlock the drive after drive power on. Without the password the drive doesn't release any useful data to the OS/applications, even if the drive is moved to another computer. ATA security, like BIOS power on supports 2 level of passwords (administrator and user).
ATA Security is not related with encryption. Data may or may not be encrypted.
I believe this security (locking the drive) is enough to protect data in all situations, and that no encryption is needed.
Encryption seems to have only one additional benefit: preventing from analyzing the platters directly and bypassing the disk controller which lock the unit. Encrypted data won't be readable. Since I don't know thieves that are clever enough for this analysis, I believe I'm ok with simple HDD lock.