DCO Lock

What is a DCO/HPA?

HPA was initially created so that drive manufacturers could change the size of a drive that is easily accessible, therefore allowing them to sell drives as if they were a smaller size. You could run a command called 'getsectors' that would allow you to see the actual size of the drive.

DCO was later released and could do the same thing as HPA, but it included other features such as being able to turn on/off drive features (like SecureErase for example). DCO also introduced the command 'NATIVE MAX' which worked the same as 'getsectors'. However, with the DCO you can change what the ouput is of 'NATIVE MAX' to be somewhere within the range of what the drive was set to show from the manufacturer and what the drive actually is. (For example, if the drive was set to show 8000 sectors, but actually has 10000 sectors, you could set the 'NATIVE MAX' to show 9000). The command 'DCO IDENT' was also added that worked the same as 'getsectors' and shows the actual size. Finally, the BIOS was configured to be able to set a 'DCO FREEZE' which makes it so that the DCO no longer responds to DCO commands (like DCO IDENT).

How Does WipeDrive Handle a DCO? 

WipeDrive first queries the drive to see if it supports DCO features. If it does, it then sends the 'DCO IDENT' command to try and see the size of the drive. If that command comes back with nothing, then WipeDrive knows that there is a DCO lock. However, it does not know if the DCO size has been altered. If a DCO lock is detected, it will show up as 'DCO-Locked: WARNING...' and 'DCO found / removed: No / No' in the log file. (See below). This is because WipeDrive knows it is locked, but does not know if there is a DCO configured.

If the 'DCO IDENT' command comes back with a sector size, then you know the DCO is not locked and WipeDrive can wipe it. This will show as 'DCO found / removed: Yes / Yes' in the log file and will not display the warning message.

How Do You Remove a DCO Lock?

The DCO becomes locked when the firmware of the machine issues the 'DEVICE CONFIGURATION FREEZE LOCK' command during power up. Power cycling the drive (not the machine) will remove the DCO lock and is the recommended method. There are three options for removing a DCO lock:

  • From WipeDrive 8.3 and forward, a feature has been added that when enabled, the computer will be put to sleep immediately before the wipe starts. Going into sleep mode power cycles the drive and is usually successful in removing the DCO lock. If WipeDrive isn't successful, you can try either increasing or decreasing the sleep time with the option 'sleep-seconds=' in the config file. It has been seen at times that a longer/shorter time is required to remove the lock. In order to enable the sleep feature, you will want to add 'device-sleep-mode=[insert-command]' into the config file. The command can either be set to auto, skip, or prompt. (ie., 'device-sleep-mode=prompt' will prompt you to restart the computer if a DCO lock is detected).
  • Alternatively, you can manually power cycle the drive. To do this, you will want to start up WipeDrive and go to the Drive Selection screen (before the wipe has begun). You will then want to unplug the power from the drive itself. Do NOT unplug the data cable. Once you've done this, wait approximately 30 seconds and then plug the power back into the drive. This will remove the DCO lock, and you can continue on with the wipe as normal.
  • As a final resort, you can also add User Defined Drive Details which will tell WipeDrive exactly how many sectors the drive has. If WipeDrive is able to see that number of sectors during the wipe, it will know that there is not a DCO lock and you will not see the DCO lock warning on the log file. For information on how to configure this information, please contact Support here.

FAQ

  • I put the drive to sleep, but the screen stays black. What do I do?

It is possible that the graphics card will not wake back up from sleep. However, the drive may still be wiping. If you encounter this, you may be able to check if the drive is still running by looking for a light on the drive (depending on the drive) or if the drive is still spinning. If you are unsure, or if the drive is still running, please wait a day to allow the drive to finish. Once finished, it will send the log file to the destination you pre-selected and you will then know that the drive is finished and is wiped. You may now power off the machine.

If this is happening frequently, you may want to consider wiping the drives in a PXE environment, as the PXE Server will show you the activity of the drive and allows you to see if the drive is still being wiped.

  • I set the commands to prompt me to put the device to sleep, but I am not seeing a prompt appear.

The prompt will only appear if the drive has DCO features. If WipeDrive does not detect that the drive has DCO features, it will not show the prompt and you can continue on as normal.

  • What are the risks of having a DCO lock on the drive?

If the drive is DCO locked (and the lock is not removed prior to wiping), WIpeDrive will not be able to wipe the sectors that are locked. WipeDrive is not able to detect how many sectors (if any) are behind the DCO lock. It is possible that WipeDrive is still wiping the entire drive, but the only way to know is to compare the sector size of the drive to the sectors WipeDrive wiped. While rare, there may be information stored on the DCO. If so, that information will persist on the drive unless the DCO is removed and WipeDrive can access the entire drive.

For any additional questions or concerns, please contact Support here or chat with us on our Live Chat during regular business hours.

  • 186
  • 21-Aug-2019
  • 106 Views