Resolving "SG_IO: bad/missing sense data" after running ATA SE on a WD My Passport USB HDD

USB storage bridges may expose ATA commands via SCSI/ATA Translation (SAT), but ATA Security behavior varies by bridge and firmware. Without an explicit vendor guarantee, reported capabilities alone do not confirm that a command can pass through the bridge and execute successfully on the drive.

To avoid orphaning data on the platters in the event of lockout, a 1 TB WD My Passport USB HDD was zeroed with dd then queried for ATA Security support:

hdparm -I /dev/sdX

/dev/sdX:

ATA device, with non-removable media
    Model Number:       WDC WD10JMVW-11AJGS1                    
...
Security: 
    Master password revision code = 48059
        supported
    not enabled
    not locked
    not frozen
    not expired: security count
        supported: enhanced erase
    332min for SECURITY ERASE UNIT. 2min for ENHANCED SECURITY ERASE UNIT.
...

Setting a password appeared to work:

hdparm --user-master u --security-set-pass p /dev/sdX
security_password: "p"

/dev/sdX:
 Issuing SECURITY_SET_PASS command, password="p", user=user, mode=high

but issuing SECURITY ERASE failed:

hdparm --user-master u --security-erase p /dev/sdX
security_password: "p"

/dev/sdX:
 Issuing SECURITY_ERASE command, password="p", user=user
SG_IO: bad/missing sense data, sb[]:  70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
SG_IO: bad/missing sense data, sb[]:  70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Decoded SCSI sense data:

sg_decode_sense 70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Fixed format, current; Sense key: Illegal Request
Additional sense: Invalid field in cdb

In other words, something in the storage path reported that the SCSI command descriptor block (cdb) used to carry the ATA request contained an invalid or unsupported field.

hdparm -I /dev/sdX initially continued to return the correct device information. However, after disconnecting and reconnecting the drive, it reported only:

/dev/sdX:

ATA device, with non-removable media
Standards:
    Likely used: 1
Configuration:
    Logical     max current
    cylinders   0   0
    heads       0   0
    sectors/track   0   0
    --
    Logical/Physical Sector size:           512 bytes
    device size with M = 1024*1024:           0 MBytes
    device size with M = 1000*1000:           0 MBytes 
    cache/buffer size  = unknown
Capabilities:
    IORDY not likely
    Cannot perform double-word IO
    R/W multiple sector transfer: not supported
    DMA: not supported
    PIO: pio0 

Attempting to unlock also failed:

hdparm --user-master u --security-unlock p /dev/sdX
security_password: "p"

/dev/sdX:
 Issuing SECURITY_UNLOCK command, password="p", user=user
SG_IO: bad/missing sense data, sb[]:  70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

WD Drive Utilities restored access to the drive:

1. Launch WD Drive Utilities; the Unlock Drive prompt will appear:

   

2. The password set with hdparm will not be accepted; enter any password five times to reveal an erase option (the Drive Erase icon remains unavailable while the drive is locked):

   

3. Set volume name and format, acknowledge the warning, and click Erase Drive. The utility erases and reinitializes the drive, restoring access:

   

   

Updates

1. Restore access to the drive without leaving Linux by using the erase function in 0-duke's WD My Passport Drive Hardware Encryption Utility for Linux:

   wdpassport-utils.py --device /dev/sdX
   Device: /dev/sdX
   Security status: Locked
   Encryption type: Full Disk Encryption

   Attempting to unlock the drive using the password set with hdparm fails, just as it does in WD's own utility:

   wdpassport-utils.py --device /dev/sdX --unlock
   [wdpassport] password for /dev/sdX: 
   [!] Key hash parameters are not valid.

   Erasing the drive, however, restores access:

   wdpassport-utils.py --device /dev/sdX --erase
   [+] All data on /dev/sdX will be lost. Are you sure you want to continue? [y/N]
   y
   [*] Device erased. You need to create a new partition on the device (Hint: fdisk and mkfs)
   
   hdparm -I /dev/sdX
   
   /dev/sdX:
   
   ATA device, with non-removable media
       Model Number:       WDC WD10JMVW-11AJGS1                    
   ...
       device size with M = 1000*1000:     1000171 MBytes (1000 GB)
       cache/buffer size  = 8192 KBytes
       Nominal Media Rotation Rate: 5400
   ...

2. Inspired by tigerblue77's AI-generated, zero-dependency unlock and eject scripts (themselves inspired by Kenny MacDermid's wdpassport-utils), I asked Astra to build a similar script for erasing WD My Passport drives. It produced erase_wd_passport.py in one shot, using only the Python 3 standard library: no pip packages, sg3-utils, hdparm, pyudev, or compiled extensions required. Tested on the 1TB drive mentioned above; your mileage may vary. All existing data will be lost, and the drive itself may be rendered unusable. Proceed at your own risk (and joy).

   #!/usr/bin/env python3 """Linux WD My Passport key reset; Python 3 standard library only. Protocol reference: https://github.com/0-duke/wdpassport-utils Replaces the encryption key, destroying access to ALL existing data. Does not perform ATA SECURITY ERASE, overwrite sectors, or format the disk. """ import argparse import ctypes as C import fcntl import os from pathlib import Path import stat import sys import time class SgIoHdr(C.Structure): # Linux include/scsi/sg.h, native ABI (do not pack). _fields_ = [ ('interface_id', C.c_int), ('dxfer_direction', C.c_int), ('cmd_len', C.c_ubyte), ('mx_sb_len', C.c_ubyte), ('iovec_count', C.c_ushort), ('dxfer_len', C.c_uint), ('dxferp', C.c_void_p), ('cmdp', C.c_void_p), ('sbp', C.c_void_p), ('timeout', C.c_uint), ('flags', C.c_uint), ('pack_id', C.c_int), ('usr_ptr', C.c_void_p), ('status', C.c_ubyte), ('masked_status', C.c_ubyte), ('msg_status', C.c_ubyte), ('sb_len_wr', C.c_ubyte), ('host_status', C.c_ushort), ('driver_status', C.c_ushort), ('resid', C.c_int), ('duration', C.c_uint), ('info', C.c_uint), ] STATES = {0: 'No lock', 1: 'Locked', 2: 'Unlocked', 6: 'Locked, unlock blocked', 7: 'No keys'} def scsi(fd, cdb, *, size=0, payload=None): writing = payload is not None length = len(payload) if writing else size data = C.create_string_buffer(payload, length) if writing else C.create_string_buffer(length) command = C.create_string_buffer(cdb, len(cdb)) sense = C.create_string_buffer(64) header = SgIoHdr(interface_id=ord('S'), dxfer_direction=-2 if writing else -3, cmd_len=len(cdb), mx_sb_len=64, dxfer_len=length, dxferp=C.addressof(data), cmdp=C.addressof(command), sbp=C.addressof(sense), timeout=60000) fcntl.ioctl(fd, 0x2285, header) # SG_IO if header.status or header.host_status or header.driver_status or header.info & 1: raise RuntimeError( f'SCSI failure: status=0x{header.status:02x}, ' f'host=0x{header.host_status:04x}, driver=0x{header.driver_status:04x}, ' f'sense={sense.raw[:header.sb_len_wr].hex(" ")}') if not 0 <= header.resid <= length or (writing and header.resid): raise RuntimeError(f'Unexpected transfer residual: {header.resid}') return data.raw[:length - header.resid] def get_status(fd): # Same allocation length and receive buffer as wdpassport-utils. data = scsi(fd, bytes.fromhex('c0 45 00 00 00 00 00 00 30 00'), size=512) if len(data) < 12 or data[0] != 0x45: raise RuntimeError('Short or invalid WD encryption-status response') return data[3], data[4], int.from_bytes(data[6:8], 'big'), data[8:12] def reset_command(status): state, cipher, key_length, token = status # Match upstream single-byte CDB length; refuse unsupported extensions. if state not in STATES or not 1 <= key_length <= 247 or len(token) != 4: raise RuntimeError('Unsupported WD status or key length; refusing reset') cdb = bytes([0xc1, 0xe3]) + token + bytes([0, 0, key_length + 8, 0]) payload = bytes([0x45, 0, 0, 0, cipher, 0, 0, 0]) + os.urandom(key_length) return cdb, payload def identify(device): dev = Path(device).resolve(strict=True) st = dev.stat() if not stat.S_ISBLK(st.st_mode): raise RuntimeError('Specify a whole block device, such as /dev/sdX') node = Path(f'/sys/dev/block/{os.major(st.st_rdev)}:{os.minor(st.st_rdev)}').resolve(strict=True) if (node / 'partition').exists(): raise RuntimeError('Partitions are not accepted; specify the whole disk') for parent in node.parents: if (parent / 'idVendor').exists(): vendor = (parent / 'idVendor').read_text().strip().lower() product = (parent / 'product').read_text().strip() if vendor != '1058' or 'passport' not in product.lower(): raise RuntimeError('Device is not identified as a WD My Passport USB drive') serial_path = parent / 'serial' serial = serial_path.read_text().strip() if serial_path.exists() else '(unavailable)' print(f'Device: {dev}\nUSB product: {product}\nUSB serial: {serial}') return str(dev), node, st.st_rdev raise RuntimeError('No USB identity found; refusing this device') def check_unused(node): nodes = [node] + [p for p in node.iterdir() if (p / 'partition').exists()] ids = {(p / 'dev').read_text().strip() for p in nodes} for p in nodes: if any((p / 'holders').iterdir()): raise RuntimeError(f'{p.name} is in use by another block device') for line in Path('/proc/self/mountinfo').read_text().splitlines(): if line.split()[2] in ids: raise RuntimeError('Drive or a partition is mounted; unmount it first') for line in Path('/proc/swaps').read_text().splitlines()[1:]: st = os.stat(line.split()[0]) if stat.S_ISBLK(st.st_mode) and f'{os.major(st.st_rdev)}:{os.minor(st.st_rdev)}' in ids: raise RuntimeError('Drive or partition is active swap; disable it first') def main(): parser = argparse.ArgumentParser(description=__doc__) parser.add_argument('device', help='Whole WD My Passport disk, e.g. /dev/sdX') parser.add_argument('--erase', action='store_true', help='Destroy all data by resetting the key') args = parser.parse_args() device, node, devnum = identify(args.device) if args.erase: check_unused(node) # O_EXCL on Linux block devices also refuses mounted/claimed devices. flags = os.O_RDWR | os.O_NONBLOCK | (os.O_EXCL if args.erase else 0) fd = os.open(device, flags) try: if os.fstat(fd).st_rdev != devnum: raise RuntimeError('Device changed while opening it') current = get_status(fd) print(f'Security: {STATES.get(current[0], "Unknown")} (0x{current[0]:02x})\n' f'Cipher: 0x{current[1]:02x}; key length: {current[2]} bytes') if not args.erase: return phrase = f'ERASE {device}' print('ALL data on this disk will become inaccessible. Keep it connected.') if input(f'Type {phrase!r} to continue: ').strip() != phrase: print('Cancelled.') return check_unused(node) # The reset token changes: fetch it immediately before sending E3. command, payload = reset_command(get_status(fd)) print('Sending WD key reset...', flush=True) try: scsi(fd, command, payload=payload) except (OSError, RuntimeError) as error: raise RuntimeError(f'Reset outcome uncertain; do not automatically retry. {error}') from error print('WD key-reset command completed successfully.') time.sleep(2) try: after = get_status(fd) print(f'After reset: {STATES.get(after[0], "Unknown")} (0x{after[0]:02x})') if after[0] not in (0, 2): raise RuntimeError('Post-reset access is not confirmed') capacity = scsi(fd, bytes.fromhex('25 00 00 00 00 00 00 00 00 00'), size=8) if len(capacity) != 8 or int.from_bytes(capacity[:4], 'big') == 0xffffffff: raise RuntimeError('Capacity could not be verified with READ CAPACITY(10)') sectors = int.from_bytes(capacity[:4], 'big') + 1 sector_size = int.from_bytes(capacity[4:], 'big') if not sector_size: raise RuntimeError('Device reported zero sector size') print(f'Reported capacity: {sectors * sector_size:,} bytes') sector = scsi(fd, bytes.fromhex('28 00 00 00 00 00 00 00 01 00'), size=sector_size) if len(sector) != sector_size: raise RuntimeError('Short first-sector read') print('First sector is readable.') except (OSError, RuntimeError) as error: raise RuntimeError(f'Reset completed, but verification failed: {error}. ' 'Reconnect and run status-only; do not repeat erase blindly.') from error try: fcntl.ioctl(fd, 0x125f) # BLKRRPART except OSError as error: print(f'Partition rescan failed ({error}); reconnect the drive.') print('Create a new partition table and filesystem before use.') finally: os.close(fd) if __name__ == '__main__': try: main() except (OSError, RuntimeError, EOFError) as error: print(f'Error: {error}', file=sys.stderr) sys.exit(1) except KeyboardInterrupt: print('\nInterrupted. If reset was sent, check status before trying again.', file=sys.stderr) sys.exit(130)

   Usage

   Without --erase, the script only queries WD encryption status:

   python3 erase_wd_passport.py /dev/sdX
   Device: /dev/sdX
   USB product: My Passport 07A8
   USB serial: XXXXXXXXXXXXXXXXXXXXXXXX
   Security: Locked (0x01)
   Cipher: 0x30; key length: 32 bytes

   To erase, unmount any mounted filesystems on the disk, then run:

   python3 erase_wd_passport.py /dev/sdX --erase
   Device: /dev/sdX
   USB product: My Passport 07A8
   USB serial: XXXXXXXXXXXXXXXXXXXXXXXX
   Security: Locked (0x01)
   Cipher: 0x30; key length: 32 bytes
   ALL data on this disk will become inaccessible. Keep it connected.
   Type 'ERASE /dev/sdX' to continue: ERASE /dev/sdX
   Sending WD key reset...
   WD key-reset command completed successfully.
   After reset: No lock (0x00)
   Reported capacity: 1,000,170,586,112 bytes
   First sector is readable.
   Create a new partition table and filesystem before use.

   What it does

   The script implements the WD encryption-key reset from 0-duke/wdpassport-utils using standard-library ctypes and fcntl.ioctl. Before resetting, it verifies the whole-disk path and WD My Passport USB identity, checks for mounts, swap, and block-device holders, opens the device exclusively, and requires explicit confirmation. It then queries the drive's encryption status and current reset token and sends WD's vendor-specific key-reset command (C1 E3), intended to replace the internal data-encryption key and make existing data inaccessible. The request includes random bytes, following upstream's implementation, but whether the firmware uses them is unverified. Afterward, the script checks security status, capacity, and first-sector readability, then requests a partition rescan. These checks confirm basic access, not secure sanitization: the operation does not overwrite user-data sectors, create a filesystem, or perform ATA SECURITY ERASE. Firmware support varies, and this is not a general fix for "SG_IO: bad/missing sense data" errors.

Related

• ATA Secure Erase (SE) and hdparm

• Accidently locked my WD My Passport 25E2400425E2WXN1EB6C

• unable to dd, smartmon, fdisk or anything on a working external Western Digital Hard Drive

• KenMacD/wdpassport-utils

  • How to set a new crypto key on your My Passport drive in Linux

  • can't rekey my 2TiB WD

• reallymine: Western Digital MyBook/MyPassport decryption

• USB devices and smartmontools

• Smartmontools USB Device Support

• USB adapters that contain a SATA controller chip that supports ATA pass through for secure erase/HPA/DCO/smart data

• What USB to IDE adapter that can send the ATA Secure Erase command?

❧ 2026-09-12

Easy Disk Checker: diagnostics, imaging, and data recovery

8 months ago, u/Routine_Eye3806 announced Easy Disk Checker for Windows on r/datarecoverysoftware:

[Dev] I created Easy Disk Checker - a free Windows utility to check HDD\SSD health and detect fake USB drives with some data recovery options (No Ads)

and it has been receiving regular updates since:

• [Dev] I updated Easy Disk Checker – my no ads free for use tool for HDD/SSD. Now with VHDX image support, easy Partition Recovery, and a built-in multi OS File Explorer
• [Dev] New version of Easy Disk Checker – my free for use, no-ads tool for HDD/SSD/Flash diagnostics, repair and data recovery
• [Dev] Easy Disk Checker 5.* — Major update with a new Data Recovery branch
• [Dev] Easy Disk Checker update: Reviving "dead" DDR 4-5 RAM by reading, parsing and repairing corrupted SPD data
• [Release] Easy Disk Checker 6.0.0 — now with a module for microcode patching to restore file access on failed SSDs (Phison first, more coming)

Current highlights include:

• Drive diagnostics: SMART attributes, Seagate FARM logs, HPA and ATA password detection, and identification of the underlying drive behind USB bridges.
• Flash identification and testing: USB controller details, NAND IDs via controller-specific commands, fake-capacity detection, and surface scans for bad sectors.
• Imaging and cloning: Raw sector images, dynamic VHD/VHDX images, partition images, disk-to-disk cloning, and file extraction from images.
• Filesystem and partition recovery: MBR/GPT recovery and file browsing/copying across FAT, exFAT, NTFS, Ext2/3/4, HFS+, APFS, and BTRFS.
• RAID and DVR recovery: Automatic reconstruction of striped, mirrored, RAID-5, and RAID-6 arrays from disks or images, plus searches for DVR recordings.
• Low-level tools: Sector hex viewing/editing and, in version 6.0, microcode patching intended to restore file access on supported failed SSDs, starting with Phison-based models.
• Beyond storage: Reading and repairing errors in DDR4 and DDR5 memory SPD dumps.

In the last update, I asked u/Routine_Eye3806 if he had shared Easy Disk Checker on HDDGURU, to which he replied that he hadn't but would appreciate me sharing it there. My submission has not received moderator approval after 2 days, so I am posting it here instead.

Additional links:

• Homepage
• Windows Store listing
• YouTube channel:
  • Easy Disk Checker: Free Utility to Analyze, Test, and Repair any HDD, SSD, USB Flash & Memory Cards
  • Data Recovery from RAID Arrays Using the Free Easy Disk Checker Utility
  • Extract Existing & Recover Lost DVR Videos | Easy Disk Checker Tutorial
  • How to Recover Data from Malfunctioning SSD | Easy Disk Checker Tutorial

❧ 2026-09-11

Create a reference Windows 11 IoT Enterprise LTSC eval VM in UTM

1. Download Windows 11 IoT Enterprise LTSC evaluation (ARM64 | x64) and utm-guest-tools-latest.iso.

2. Create the VM with "Install drivers and SPICE tools" unchecked (otherwise, clicking "I don't have a product key" during setup will fail with "Setup has failed to validate the product key").

3. Disconnect from the network, then install Windows.

4. Install UTM Guest Tools: Virtual Machine → Drives → CD/DVD…iso → Change → select utm-guest-tools-latest.iso → run D:\utm-guest-tools-0.1.271.exe. Eject when done.

5. Customize Windows as desired (taskbar, desktop background, dark mode, File Explorer, Edge, etc.), shut down, and save as your reference image.

6. Reconnect to the network, clone the reference VM, and boot the clone.

7. Windows should activate automatically and the desktop watermark change from "Windows License is expired" to "Windows License valid for 90 days". If not, run cscript //nologo %windir%\system32\slmgr.vbs /ato and reboot. If activation fails due to no network connectivity, try setting a public DNS server or switching from Shared Network to Bridged (Advanced).

❧ 2026-09-07

macOS native window management à la Rectangle

After years of happy Rectangle and Spectacle use, had missed that native window tiling was added in macOS Sequoia: Settings → Keyboard → Keyboard Shortcuts… → Windows.

Default keyboard shortcuts:

❧ 2026-09-07

Safely shut down during OOBE in Windows, macOS, and Linux Mint

These out-of-box experiences (OOBE) offer no obvious shutdown option, but each can still be powered off gracefully:

• Windows: Shift+F10 → shutdown /s /t 0

• macOS: Cmd+Q → Shut Down

• Linux Mint (first boot after an OEM install): Ctrl+Alt+F2 → once the text console appears, quickly press and release the power button to shut down safely. GRUB may appear on next boot; one complete startup clears recordfail and re-hides the menu.

❧ 2026-09-05

File recovery from a degraded drive without imaging

Recover files from a failing drive without cloning posted to the docs section.

❧ 2026-08-20

Wandering the well-worn sidepaths to nowhere

"In one particular the civilized man still is brother to the savage: His thoughts seldom rise above the dust of which he is made."

—Robert Quillen, "When Guests Saw Only the Parlor, There Was Trash in the Closets", The State, October 22, 1929, p. 4.

❧ 2026-08-19

Check provenance of AI-generated images

• Verify OpenAI-generated content: "Check for signals that it was generated with OpenAI tools."

• Verify AI-generated images, videos and audio: Gemini checks for SynthID or Content Credentials markers.

• Inspect Content Credentials: "Content Credentials are still rolling out, so the content you choose to inspect may not have information to view."

• SynthID Detector: "Detect invisible AI watermarks from ChatGPT, Google Gemini, and Imagen. Works on text, images, and audio — results in under 3 seconds." One free check then signup required.

• Detect AI-generated images: "The highest accuracy for AI-generated media detection"

• Detect AI-Generated & Deepfake Content: "Upload images, video, or audio to detect AI-generated or deepfake content using best-in-class models."

• How to Detect AI-Generated Images Using Metadata: ExifTool instructions and more.

• Pangram: Check images or text. Sign up required. Four free AI checks a day.

Related

• Anthropic says it will watermark text generated by its AI models

• Anthropic pledges to embed watermarks to help discern AI slop in sop to EU

• Anthropic Posts 'How Claude Marks AI-Generated Content' Without Explaining How Claude Marks AI-Generated Content

❧ 2026-08-12

DaisyDisk free & open source alternatives

❧ 2026-08-12

Why plain text email, 2026 edition

Gareth Heyes, CSS: the bomb inside your inbox:

"It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this paper I'm going to show you how to break out of trust boundaries, exfiltrate tokens, compromise 3rd party websites and even steal passwords."

Previously:

• 2001: Why HTML in E-Mail is a Bad Idea

• 2002: 7 reasons why HTML e-mail is EVIL

• 2004: HTML email considered harmful | use plain text email

• 2006: Force Apple Mail to Display Incoming Messages as Plain Text

• 2009: Just say no to HTML email and proprietary attachments

• 2011: Test your mail client's leakiness

❧ 2026-08-07