Gallery: Key Masters: 4 Portable Secure Hard Drives Tested
01overview-advice
Basics: __What extra protection does hardware encryption add?__ A system password is a software program like any other, so a determined thief can remove the hard drive from your computer, attach it to another machine, and crack the password. But these drives won't even mount on a PC desktop unless you first pass a hardware-based authentication test: typing a PIN on a keypad, swiping a fingerprint, tapping an RFID badge, or entering a code displayed on a separate dongle. Fail the hardware tests and the drive locks up. Even if somebody cracks open the case and removes the drive, there's still a 128- or 256-bit military-grade encryption algorithm built into the firmware, so your data is run through a digital Cuisinart before it's even written to the disk, rendering it unreadable. __So they're uncrackable?__ No. No encryption is. But if you store your sensitive info on one of these drives, there's a very good chance nobody will ever see it without your say-so. Brazilian and FBI codebreakers spent two years trying to decipher data on the hardware-secured drives of a Brazilian banker suspected of money laundering—before giving up in 2010. __What if I lose my passcode?__ All these drives have an admin mode; admins can create codes for up to 10 or so users and can reset a forgotten code. If you're not the admin, the "forgot my passcode" drill is somewhat forgiving. You get up to 25 attempts, after which the drive will require a factory-programmed fail-safe code to enable more PIN entries. After 50 or so failed attempts, the drive assumes it's under attack and self-destructs. Buying Advice These drives cost two to five times as much as unprotected drives -- if you just want to stash your Beatles MP3s, look elsewhere. Chip-based 256-bit encryption and security features like automatic self-destruct are the norm, so all these drives offer the same base level of protection. Your decision should come down to transfer speed, keypad usability, and, if your data is top-secret, the inclusion of secondary authenticators like smartcards and RFID readers.
02apricorn-aegis-padlock-3
Apricorn Aegis Padlock 3 ------------------------ The [Aegis Padlock](http://www.apricorn.com/products/hardware-encrypted-drives/apricorn-padlock-usb3.html) ($190 for 500GB) is fast and brawny -- its USB 3.0 data transfers are nearly 10 times quicker than USB 2.0, and the built-in AES encryption chip (choose between 128- and 256-bit protection) is coated in epoxy, which can't be compromised without damaging the circuitry beyond repair. Though muscular, the 6.2-ounce Padlock is small enough to slip into your pocket, and it comes with an integrated USB cable you'll never lose. The keypad is large and easy to type on, and because it has both numbers and letters (just like a telephone), passcodes can be a string of digits or a phrase. Usability is an issue, though. While the initial setup was easy and the keypad registers strokes accurately, creating individual passcodes for multiple users was frustrating, and decoding the cryptic alerts afforded by the flashing three-color LED required too much manual-digging. Clearly aimed at the corporate market, the Padlock is still a reasonable choice for individuals who want its lightning-quick performance and double-edged security. The drive comes formatted for Windows but will work with Mac and Linux systems as well with a reformat. __WIRED__ Warp-speed USB 3.0 file transfers. Good for groups: Stores up to 5 unique passcodes. Configurable auto-lock has a self-destruct feature that wipes the drive when intruders try to get in. SSD model also available. __TIRED__ Confounding passcode management. Hogs two USB ports on some computers.
03rocstor-rocsafe-mx
Rocstor Rocsafe MX ------------------ To access the [Rocsafe](http://www.rocstor.com/products/rocsafe-mx.html) ($589 for 750GB), you need to enter a PIN and insert a smartcard. Add the 256-bit AES encryption chip and you've got a system so tight even the CIA can't gain entry -- let alone your humble reviewer. Setup sounds routinely simple. After plugging in the two-port USB cable, I inserted one of the supplied smartcards in the front slot. Then, I entered the default PIN on the Rocsafe's touchscreen keypad. Or, at least I thought I did. Unlike hardware buttons which give tactile feedback, the touchscreen offers only a weak and easily missed, micro-second flash on the tapped key. And the default PIN is buried on page 16 of its 65-page PDF manual. Anyway, I got it right on the third try. The drive will permanently lock up after eight failed PIN entries, so the manual advises calling tech support after the fifth failed attempt. Good idea. The Rocsafe MX sports only USB 2.0, which makes this drive somewhat of a slowpoke when compared to other drives outfitted with USB 3.0. Moving a 4GB file from a PC took over nine minutes. USB 3.0 typically delivers the same file in 50 to 70 seconds. Most portable secure drives can be set to automatically lock after set periods of inactivity. The Rocsafe MX does not. After you've successfully mounted the hard drive, it stays active and accessible (even if you remove the smartcard), until it's physically detached from the USB port. So, although the three layers of security should allay even the most paranoid, this is severely undercut by the lack of an auto-lock feature that kicks in when the drive is left unattended. __WIRED__ Strong multilevel security. Rugged case can take a beating. Includes two smartcards -- give the extra to your shady attorney for safe keeping. __TIRED__ Only USB 2.0 and FireWire ports. No auto-lock. Very expensive.
04reviews-secure-hard-drives4-f.jpg
Lenovo ThinkPad USB 3.0 Secure Drive ------------------------------------ Lenovo's [ThinkPad secure hard drive](http://shop.lenovo.com/SEUILibrary/controller/e/web/LenovoPortal/en_US/catalog.workflow:item.detail?GroupID=460&Code=0A65616) ($190 for 500 GB) is wrapped in the same velvety black skin found on the company's ThinkPad notebooks, and it has the same excellent key-feel, too, so we never mistyped a PIN. Its takes a layered approach to password security with two defined roles -- administrator and user -- making it a smart choice for both individuals and teams made up of multiple users. Setup out of the box is brain-dead simple. After attaching the onboard 5-inch USB cable (an extension cable is included), enter the supplied default password on the responsive, soft-touch telephone-style keypad, press the unlock button, and you're connected. The administrator can enroll ten separate users, each with his or her own passcode. Separate key unlock combinations are needed to enter either the "Administrator" mode or the "User" mode, followed by their respective pass codes. All steps are confirmed by the single LED which flashes red, green, and blue accordingly. If anyone forgets their password, or if an unauthorized person attempts entry, the disk locks up after six failed PIN attempts. The drive must be removed and reconnected to the PC for another go at it. After 25 failed entries, the drive totally locks. But -- all is not yet lost. A convoluted procedure outlined in the user manual gains you re-entry for another 25 password attempts (of course the PDF manual is stored on the drive, so it’s best to copy it locally on the initial login). If any passcode is entered incorrectly 50 consecutive times, the brute force self-destruct feature kicks in, wiping all data. The tight security on the ThinkPad drive is driven by the hardware-based 256-bit AES encryption, and the customizable auto-lock switches on after periods of 5, 10 or 20 minutes of inactivity. It also travels well; the pocket-size slab weighs just 7 ounces, and a 16-point omnidirectional shock-mount system guards against accidental drops. It's reasonably fast, too, though not up to the Apricorn's blazing pace. __WIRED__ Alphanumeric keypad was the best I used. USB cable is attached, so there are no pieces to forget. __TIRED__ Could be faster over USB 3.0, and transfers over USB 2.0 are glacial. Maximum available capacity is only 750 GB.
05datalocker-dl3
DataLocker DL3 -------------- Typing on the DL3's backlit touchscreen keypad is easy, but you're also protected against "shoulder surfers" by a randomizer that shuffles the key layout after each use. What appears to be a normal keypad with sequential numbers one time will have a totally different order the next. And although the touch screen keypad offers no physical feedback, on-screen and audio acknowledgement of entries serve just as well. Our [DataLocker DL3](http://www.datalocker.com/products/datalocker-dl3.html) ($430 for 500GB) came with an RFID module for secondary authentication. Each time you want to connect the drive to a computer, you must first tap the small, chiclet-sized RFID tag to right corner of the drive, then enter your PIN on the keypad. You associate the RFID chip with the drive when you first unbox it -- after entering the default PIN, the drive asks you to create your own personal PIN, register the two included RFID tags, and handle other housekeeping tasks. Upon registration of each RFID dongle, a unique tag number appears on the touchscreen. Write it down, because if you misplace or lose the RFID tag (and it's just small enough for this to happen), the unique ID number can still be entered manually on the keypad for entry. DataLocker's drive has a two-tiered permissions structure, with the dministrator controlling all functions, and users allowed read/write privileges only. As far as performance goes, the 5400RPM drive won’t win any races. My 4GB test file took over two minutes to copy when connected in USB 3.0 mode, and a watch-the-paint-dry 10 minutes with USB 2.0. Finally, the DL3 lacks a time-based auto-lock -- it uses a handy "Disconnect" button that appears when the drive is active -- so it's suitable as a stash box only for the true paranoid who would never leave it attached and unattended. __WIRED__ Layered security: RFID, PIN, keypad scrambler, and AES 256-bit encryption. Best touchscreen I tried. __TIRED__ Expensive, though non-RFID models are cheaper. No auto-lock = security hole. Supports USB 3.0, but read/write speeds are not its strong suit.
