7

ThinkPads have a "Hard Disk Password" hard drive protection system, see image below.

I have read BIOS Hard Drive Password Security? but a few things are still unclear to me. Is this sytem:

  • a simple lock that can be easily bypassed if I move the HDD/SSD to another computer?

  • something linked to an internal-disk encryption system? If so, what happens if I move the disk to another computer that does not have this BIOS option?

  • something linked to TPM?

  • something else?

TL;DR: Does enabling this Hard Disk1 Password change the state of the disk itself, i.e. a few byes will be modified on the disk (either in boot partition or internal-disk settings), or will this let the drive totally unchanged and only modify the local computer BIOS settings?

enter image description here

Basj
  • 1,809
  • 12
  • 58
  • 100
  • The feature is NOT linked to TPM. TPM is used to store a key, a key used in encryption, that feature is not linked to encryption. – Ramhound Jun 22 '20 at 13:39

2 Answers2

4

Following @John's answer, I did a few tests, and here are the results.

First set a "Hard Disk1 Password" on HDD1 of ThinkPad A, and take the disk out (in my case a Samsung SSD).

  1. Put it in ThinkPad B, as internal hard drive

    • the password is asked on ThinkPad B startup, so this confirms that the password protection is written somewhere on the disk and not only in ThinkPad A's BIOS

    • if we don't enter the correct password, no boot is possible (it's not possible to bypass this and continue the boot with the other internal HDD)

  2. Put it in ThinkPad B, in the "HDD caddy" tray, hotplug-style, after Windows startup: the disk is not available, it does not even appear in the partitions of diskmgmt.msc; the blocking seems to be low-level

  3. Connect it to ThinkPad B, as a USB external drive, with a USB-SATA cable, after Windows startup: same than 2.

  4. Connect it to ThinkPad B, as a USB external drive, with a USB-SATA cable, before boot: the boot of ThinkPad B is slowed down / nearly crashing (?)

  5. Connect it to another PC than a ThinkPad (e.g. a PC with a BIOS that does not support HDD Password), as internal drive, before boot:

    • The disk is visible in the devices (example: from BIOS boot menu)

    • lsblk shows /dev/sdb 931 GB, but no partition is detected (no /dev/sdb1, /dev/dsb2, etc.)

  6. Connect it to another PC than a ThinkPad, as USB drive (with a USB-SATA cable): no partition visible

  7. Connect it to ThinkPad B internally, enter the password, go to BIOS and remove the password. Then connect it to ThinkPad A: the password is well removed, as expected.

So it looks like a good protection technique, not easily bypassable.

PS:

Basj
  • 1,809
  • 12
  • 58
  • 100
2

The ThinkPad HD password is not linked to TPM as noted earlier.

However the HD password is stored on the drive.

It is not easily defeated. If you move the drive to another computer, you will need the HD password to access the drive.

Removing the BIOS password (if one) does not change the above statement.

I have been using the Lenovo HD Password for years and two laptops here have that function enabled. I also have the BIOS user password set to the same value. No one but me can start my computers (even with a bootable USB Key).

John
  • 49,923
  • 1
    Ok, good to know! So this means it's really stored on the disk... Is it a normalized standard supported by all hard drive manufacturers; if os what's its name? Also, if I set a password with computer A, what happens if I move to computer B which doesn't have this BIOS option? – Basj Jun 22 '20 at 13:54
  • 1
    I have done this (2 same computers a while back). Without the HD Password (even if no BIOS password), you will not be able to start or work with the drive. Disabling the BIOS password does not affect the HD password. – John Jun 22 '20 at 13:56
  • Good to know, I'll test it too on 2 different computers. So this means we could avoid BitLocker or such systems, and just rely on this Password system? i.e. if someone steals my computer and moves the SSD to another computer, he can't read anyting? – Basj Jun 22 '20 at 14:00
  • That is correct. Make sure the password is not simple (e.g. not 12345) – John Jun 22 '20 at 14:01
  • Thanks! Last thing: let's say my thinkpads die, and I have to use it in a HP (which might have a different BIOS), will it have the same password system? Is there a name/specification for this HDD password system? – Basj Jun 22 '20 at 14:03
  • I do not think that will work. While the HD password has a component on the drive, the setup is controlled by the ThinkPad (Lenovo) BIOS. So no, moving to a different brand of computer with the same BIOS password will not work. – John Jun 22 '20 at 14:05
  • Thanks again @John. Following your answer, I ran similar tests this afternoon, and here are the results: https://superuser.com/questions/1562921/hard-disk1-password-in-thinkpad-bios/1562964#1562964 – Basj Jun 22 '20 at 16:11
  • 1
    You are very welcome. Good luck with your drives and protection. – John Jun 22 '20 at 16:24
  • PS @John: I added 4 links at the end of my answer, and this one might be useful in case of failure of your ThinkPad: https://github.com/jethrogb/lenovo-password – Basj Jun 22 '20 at 21:06