Resolving "SG_IO: bad/missing sense data" after running ATA SE on a WD My Passport USB HDD

USB storage bridges may expose ATA commands via SCSI/ATA Translation (SAT), but ATA Security behavior varies by bridge and firmware. Without an explicit vendor guarantee, reported capabilities alone do not confirm that a command can pass through the bridge and execute successfully on the drive.

To avoid orphaning data on the platters in the event of lockout, a 1 TB WD My Passport USB HDD was zeroed with dd then queried for ATA Security support:

hdparm -I /dev/sdX

/dev/sdX:

ATA device, with non-removable media
    Model Number:       WDC WD10JMVW-11AJGS1                    
...
Security: 
    Master password revision code = 48059
        supported
    not enabled
    not locked
    not frozen
    not expired: security count
        supported: enhanced erase
    332min for SECURITY ERASE UNIT. 2min for ENHANCED SECURITY ERASE UNIT.
...

Setting a password appeared to work:

hdparm --user-master u --security-set-pass p /dev/sdX
security_password: "p"

/dev/sdX:
 Issuing SECURITY_SET_PASS command, password="p", user=user, mode=high

but issuing SECURITY ERASE failed:

hdparm --user-master u --security-erase p /dev/sdX
security_password: "p"

/dev/sdX:
 Issuing SECURITY_ERASE command, password="p", user=user
SG_IO: bad/missing sense data, sb[]:  70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
SG_IO: bad/missing sense data, sb[]:  70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Decoded SCSI sense data:

sg_decode_sense 70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Fixed format, current; Sense key: Illegal Request
Additional sense: Invalid field in cdb

In other words, something in the storage path reported that the SCSI command descriptor block (cdb) used to carry the ATA request contained an invalid or unsupported field.

hdparm -I /dev/sdX initially continued to return the correct device information. However, after disconnecting and reconnecting the drive, it reported only:

/dev/sdX:

ATA device, with non-removable media
Standards:
    Likely used: 1
Configuration:
    Logical     max current
    cylinders   0   0
    heads       0   0
    sectors/track   0   0
    --
    Logical/Physical Sector size:           512 bytes
    device size with M = 1024*1024:           0 MBytes
    device size with M = 1000*1000:           0 MBytes 
    cache/buffer size  = unknown
Capabilities:
    IORDY not likely
    Cannot perform double-word IO
    R/W multiple sector transfer: not supported
    DMA: not supported
    PIO: pio0

Attempting to unlock also failed:

hdparm --user-master u --security-unlock p /dev/sdX
security_password: "p"

/dev/sdX:
 Issuing SECURITY_UNLOCK command, password="p", user=user
SG_IO: bad/missing sense data, sb[]:  70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

WD Drive Utilities restored access to the drive:

Launch WD Drive Utilities; the Unlock Drive prompt will appear:
The password set with hdparm will not be accepted; enter any password five times to reveal an erase option (the Drive Erase icon remains unavailable while the drive is locked):
Set volume name and format, acknowledge the warning, and click Erase Drive. The utility erases and reinitializes the drive, restoring access:

Updates

Restore access to the drive without leaving Linux by using the erase function in 0-duke's WD My Passport Drive Hardware Encryption Utility for Linux:

wdpassport-utils.py --device /dev/sdX
Device: /dev/sdX
Security status: Locked
Encryption type: Full Disk Encryption

Attempting to unlock the drive using the password set with hdparm fails, just as it does in WD's own utility:

wdpassport-utils.py --device /dev/sdX --unlock
[wdpassport] password for /dev/sdX: 
[!] Key hash parameters are not valid.

Erasing the drive, however, restores access:

wdpassport-utils.py --device /dev/sdX --erase
[+] All data on /dev/sdX will be lost. Are you sure you want to continue? [y/N]
y
[*] Device erased. You need to create a new partition on the device (Hint: fdisk and mkfs)

hdparm -I /dev/sdX

/dev/sdX:

ATA device, with non-removable media
    Model Number:       WDC WD10JMVW-11AJGS1                    
...
    device size with M = 1000*1000:     1000171 MBytes (1000 GB)
    cache/buffer size  = 8192 KBytes
    Nominal Media Rotation Rate: 5400
...

Inspired by tigerblue77's AI-generated, zero-dependency unlock and eject scripts (themselves inspired by Kenny MacDermid's wdpassport-utils), I asked Astra to build a similar script for erasing WD My Passport drives. It produced erase_wd_passport.py in one shot, using only the Python 3 standard library: no pip packages, sg3-utils, hdparm, pyudev, or compiled extensions required. Tested on the 1TB drive mentioned above; your mileage may vary. All existing data will be lost, and the drive itself may be rendered unusable. Proceed at your own risk (and joy).
#!/usr/bin/env python3 """Linux WD My Passport key reset; Python 3 standard library only. Protocol reference: https://github.com/0-duke/wdpassport-utils Replaces the encryption key, destroying access to ALL existing data. Does not perform ATA SECURITY ERASE, overwrite sectors, or format the disk. """ import argparse import ctypes as C import fcntl import os from pathlib import Path import stat import sys import time class SgIoHdr(C.Structure): # Linux include/scsi/sg.h, native ABI (do not pack). _fields_ = [ ('interface_id', C.c_int), ('dxfer_direction', C.c_int), ('cmd_len', C.c_ubyte), ('mx_sb_len', C.c_ubyte), ('iovec_count', C.c_ushort), ('dxfer_len', C.c_uint), ('dxferp', C.c_void_p), ('cmdp', C.c_void_p), ('sbp', C.c_void_p), ('timeout', C.c_uint), ('flags', C.c_uint), ('pack_id', C.c_int), ('usr_ptr', C.c_void_p), ('status', C.c_ubyte), ('masked_status', C.c_ubyte), ('msg_status', C.c_ubyte), ('sb_len_wr', C.c_ubyte), ('host_status', C.c_ushort), ('driver_status', C.c_ushort), ('resid', C.c_int), ('duration', C.c_uint), ('info', C.c_uint), ] STATES = {0: 'No lock', 1: 'Locked', 2: 'Unlocked', 6: 'Locked, unlock blocked', 7: 'No keys'} def scsi(fd, cdb, *, size=0, payload=None): writing = payload is not None length = len(payload) if writing else size data = C.create_string_buffer(payload, length) if writing else C.create_string_buffer(length) command = C.create_string_buffer(cdb, len(cdb)) sense = C.create_string_buffer(64) header = SgIoHdr(interface_id=ord('S'), dxfer_direction=-2 if writing else -3, cmd_len=len(cdb), mx_sb_len=64, dxfer_len=length, dxferp=C.addressof(data), cmdp=C.addressof(command), sbp=C.addressof(sense), timeout=60000) fcntl.ioctl(fd, 0x2285, header) # SG_IO if header.status or header.host_status or header.driver_status or header.info & 1: raise RuntimeError( f'SCSI failure: status=0x{header.status:02x}, ' f'host=0x{header.host_status:04x}, driver=0x{header.driver_status:04x}, ' f'sense={sense.raw[:header.sb_len_wr].hex(" ")}') if not 0 <= header.resid <= length or (writing and header.resid): raise RuntimeError(f'Unexpected transfer residual: {header.resid}') return data.raw[:length - header.resid] def get_status(fd): # Same allocation length and receive buffer as wdpassport-utils. data = scsi(fd, bytes.fromhex('c0 45 00 00 00 00 00 00 30 00'), size=512) if len(data) < 12 or data[0] != 0x45: raise RuntimeError('Short or invalid WD encryption-status response') return data[3], data[4], int.from_bytes(data[6:8], 'big'), data[8:12] def reset_command(status): state, cipher, key_length, token = status # Match upstream single-byte CDB length; refuse unsupported extensions. if state not in STATES or not 1 <= key_length <= 247 or len(token) != 4: raise RuntimeError('Unsupported WD status or key length; refusing reset') cdb = bytes([0xc1, 0xe3]) + token + bytes([0, 0, key_length + 8, 0]) payload = bytes([0x45, 0, 0, 0, cipher, 0, 0, 0]) + os.urandom(key_length) return cdb, payload def identify(device): dev = Path(device).resolve(strict=True) st = dev.stat() if not stat.S_ISBLK(st.st_mode): raise RuntimeError('Specify a whole block device, such as /dev/sdX') node = Path(f'/sys/dev/block/{os.major(st.st_rdev)}:{os.minor(st.st_rdev)}').resolve(strict=True) if (node / 'partition').exists(): raise RuntimeError('Partitions are not accepted; specify the whole disk') for parent in node.parents: if (parent / 'idVendor').exists(): vendor = (parent / 'idVendor').read_text().strip().lower() product = (parent / 'product').read_text().strip() if vendor != '1058' or 'passport' not in product.lower(): raise RuntimeError('Device is not identified as a WD My Passport USB drive') serial_path = parent / 'serial' serial = serial_path.read_text().strip() if serial_path.exists() else '(unavailable)' print(f'Device: {dev}\nUSB product: {product}\nUSB serial: {serial}') return str(dev), node, st.st_rdev raise RuntimeError('No USB identity found; refusing this device') def check_unused(node): nodes = [node] + [p for p in node.iterdir() if (p / 'partition').exists()] ids = {(p / 'dev').read_text().strip() for p in nodes} for p in nodes: if any((p / 'holders').iterdir()): raise RuntimeError(f'{p.name} is in use by another block device') for line in Path('/proc/self/mountinfo').read_text().splitlines(): if line.split()[2] in ids: raise RuntimeError('Drive or a partition is mounted; unmount it first') for line in Path('/proc/swaps').read_text().splitlines()[1:]: st = os.stat(line.split()[0]) if stat.S_ISBLK(st.st_mode) and f'{os.major(st.st_rdev)}:{os.minor(st.st_rdev)}' in ids: raise RuntimeError('Drive or partition is active swap; disable it first') def main(): parser = argparse.ArgumentParser(description=__doc__) parser.add_argument('device', help='Whole WD My Passport disk, e.g. /dev/sdX') parser.add_argument('--erase', action='store_true', help='Destroy all data by resetting the key') args = parser.parse_args() device, node, devnum = identify(args.device) if args.erase: check_unused(node) # O_EXCL on Linux block devices also refuses mounted/claimed devices. flags = os.O_RDWR | os.O_NONBLOCK | (os.O_EXCL if args.erase else 0) fd = os.open(device, flags) try: if os.fstat(fd).st_rdev != devnum: raise RuntimeError('Device changed while opening it') current = get_status(fd) print(f'Security: {STATES.get(current[0], "Unknown")} (0x{current[0]:02x})\n' f'Cipher: 0x{current[1]:02x}; key length: {current[2]} bytes') if not args.erase: return phrase = f'ERASE {device}' print('ALL data on this disk will become inaccessible. Keep it connected.') if input(f'Type {phrase!r} to continue: ').strip() != phrase: print('Cancelled.') return check_unused(node) # The reset token changes: fetch it immediately before sending E3. command, payload = reset_command(get_status(fd)) print('Sending WD key reset...', flush=True) try: scsi(fd, command, payload=payload) except (OSError, RuntimeError) as error: raise RuntimeError(f'Reset outcome uncertain; do not automatically retry. {error}') from error print('WD key-reset command completed successfully.') time.sleep(2) try: after = get_status(fd) print(f'After reset: {STATES.get(after[0], "Unknown")} (0x{after[0]:02x})') if after[0] not in (0, 2): raise RuntimeError('Post-reset access is not confirmed') capacity = scsi(fd, bytes.fromhex('25 00 00 00 00 00 00 00 00 00'), size=8) if len(capacity) != 8 or int.from_bytes(capacity[:4], 'big') == 0xffffffff: raise RuntimeError('Capacity could not be verified with READ CAPACITY(10)') sectors = int.from_bytes(capacity[:4], 'big') + 1 sector_size = int.from_bytes(capacity[4:], 'big') if not sector_size: raise RuntimeError('Device reported zero sector size') print(f'Reported capacity: {sectors * sector_size:,} bytes') sector = scsi(fd, bytes.fromhex('28 00 00 00 00 00 00 00 01 00'), size=sector_size) if len(sector) != sector_size: raise RuntimeError('Short first-sector read') print('First sector is readable.') except (OSError, RuntimeError) as error: raise RuntimeError(f'Reset completed, but verification failed: {error}. ' 'Reconnect and run status-only; do not repeat erase blindly.') from error try: fcntl.ioctl(fd, 0x125f) # BLKRRPART except OSError as error: print(f'Partition rescan failed ({error}); reconnect the drive.') print('Create a new partition table and filesystem before use.') finally: os.close(fd) if __name__ == '__main__': try: main() except (OSError, RuntimeError, EOFError) as error: print(f'Error: {error}', file=sys.stderr) sys.exit(1) except KeyboardInterrupt: print('\nInterrupted. If reset was sent, check status before trying again.', file=sys.stderr) sys.exit(130)
Usage

Without --erase, the script only queries WD encryption status:
```
python3 erase_wd_passport.py /dev/sdX
Device: /dev/sdX
USB product: My Passport 07A8
USB serial: XXXXXXXXXXXXXXXXXXXXXXXX
Security: Locked (0x01)
Cipher: 0x30; key length: 32 bytes
```
To erase, unmount any mounted filesystems on the disk, then run:
```
python3 erase_wd_passport.py /dev/sdX --erase
Device: /dev/sdX
USB product: My Passport 07A8
USB serial: XXXXXXXXXXXXXXXXXXXXXXXX
Security: Locked (0x01)
Cipher: 0x30; key length: 32 bytes
ALL data on this disk will become inaccessible. Keep it connected.
Type 'ERASE /dev/sdX' to continue: ERASE /dev/sdX
Sending WD key reset...
WD key-reset command completed successfully.
After reset: No lock (0x00)
Reported capacity: 1,000,170,586,112 bytes
First sector is readable.
Create a new partition table and filesystem before use.
```
What it does

The script implements the WD encryption-key reset from 0-duke/wdpassport-utils using standard-library ctypes and fcntl.ioctl. Before resetting, it verifies the whole-disk path and WD My Passport USB identity, checks for mounts, swap, and block-device holders, opens the device exclusively, and requires explicit confirmation. It then queries the drive's encryption status and current reset token and sends WD's vendor-specific key-reset command (C1 E3), intended to replace the internal data-encryption key and make existing data inaccessible. The request includes random bytes, following upstream's implementation, but whether the firmware uses them is unverified. Afterward, the script checks security status, capacity, and first-sector readability, then requests a partition rescan. These checks confirm basic access, not secure sanitization: the operation does not overwrite user-data sectors, create a filesystem, or perform ATA SECURITY ERASE. Firmware support varies, and this is not a general fix for "SG_IO: bad/missing sense data" errors.

❧ 2026-09-12

Resolving "SG_IO: bad/missing sense data" after running ATA SE on a WD My Passport USB HDD

Updates

Related