Lenovo ThinkServer RD330 MegaRAID SAS Software User Guide - Page 179

MegaRAID SAS Software User Guide Chapter 5: MegaRAID Command Tool | SafeStore Security Options 5.7 SafeStore Security Options 5.7.1 Use Instant Secure Erase on a Physical Drive Use the commands in this section to manage the SafeStore Security feature. This feature offers the ability to encrypt data on disks and use disk-based key management to provide data security. With this feature, data is encrypted by the drives. You can designate which data to encrypt at the individual virtual drive (VD) level. This solution provides data protection in the event of theft or loss of physical drives. With self-encrypting disks, if you remove a drive from its storage system or the server it is housed in, the data on that drive is encrypted and useless to anyone who attempts to access without the appropriate security authorization. Any encryption solution requires management of the encryption keys. This feature provides a way to manage these keys. You can change the encryption key for all ServeRAID controllers that are connected to SED drives. All SED drives, whether locked or unlocked, always have an encryption key. This key is set by the drive and is always active. When the drive is unlocked, the data to host from the drive (on reads) and from the host to the drive cache (on writes) is always provided. However, when resting on the drive platters, the data is always encrypted by the drive. In the following options, [E0:S0, E1:S1] specifies the enclosure ID and slot ID for the drive. See Chapter 3, SafeStore Disk Encryption for more information about the SED feature. Use the command in the following table to perform an Instant Secure Erase of data on a physical drive. The Instant Secure Erase feature lets you erase data on SED drives. Table 28: Use Instant Secure Erase on a Physical Drive Convention Description MegaCli -PDInstantSecureErase -PhysDrv[E0:S0,E1:S1,...] | [-Force] -aN|-a0,1,2|-aALL Erases the data on a specified drive or drives. -PDInstantSecureErase: Use the Instant Secure Erase feature to erase data on a drive or drives. -PhysDrv[E0:S0,...]: Specifies the drive(s) that you want to perform the Instant Secure Erase on. -Force: Specifies that the MegaCLI utility does not ask you for confirmation before it performs this command (you might lose data using this option with some commands). NOTE: NOTE: Previously -szXXX expressed capacity in MB but now you can enter the capacity in your choice of units. For example, to create a virtual drive of 10 GB, enter the size as sz10GB. If you do not enter a unit, by default it is considered as MB. 5.7.2 Secure Data on a Virtual Drive Use the command in the following table to secure data on a virtual drive. Table 29: Secure Data on a Virtual Drive Convention Description MegaCli -LDMakeSecure -Lx|-L0,1,2,...|-Lall -aN|-a0,1,2|-aALL Secures data on a specified virtual drive or drives. Page 179