If drive is frozen, unfreeze

$ sudo hdparm -I /dev/sdx
Security:
  Master password revision code = 65534
          supported
  not enabled
  not locked
          frozen
  not expired: security count
          supported: enhanced erase
  168min for SECURITY ERASE UNIT. 168min for ENHANCED SECURITY ERASE UNIT.

The drive is currently frozen. Sleep and wake computer to unfreeze.† Your output should now show:

$ sudo hdparm -I /dev/sdx
Security:
  Master password revision code = 65534
          supported
  not enabled
  not locked
  not frozen

Set password (req'd for using SE)

$ sudo hdparm --user-master u --security-set-pass p /dev/sdx
security_password="p"

/dev/sdx:
 Issuing SECURITY_SET_PASS command, password="p", user=user, mode=high

Security should now be enabled:

$ sudo hdparm -I /dev/sdx
Security:
  Master password revision code = 65534
          supported
          enabled
  not locked
  not frozen
  not expired: security count
          supported: enhanced erase
  Security level high

Erase drive

$ sudo hdparm --user-master u --security-erase p /dev/sdx
security_password="p"

/dev/sdx:
 Issuing SECURITY_ERASE command, password="p", user=user

If your drive supports enhanced erase, you may want to substitute security-erase-enhanced for security-erase. The difference, according to the HDDerase.exe FAQ:

Secure erase overwrites all user data areas with binary zeroes. Enhanced secure erase writes predetermined data patterns (set by the manufacturer) to all user data areas, including sectors that are no longer in use due to reallocation.

If drive is locked, unlock & disable security

Upon completion, security should automatically switch back to disabled. If not, you will need to disable it manually. However, note that in such a case, Secure Erase likely did not complete successfully, leaving the drive only partially wiped. This can be caused by the 2 hour timeout in versions prior to 9.31, for example.

$ sudo hdparm -I /dev/sdx
Security:
  Master password revision code = 65534
          supported
          enabled
          locked
  not frozen
  not expired: security count
  supported: enhanced erase
  Security level high
  168min for SECURITY ERASE UNIT. 168min for ENHANCED SECURITY ERASE UNIT.

Let's unlock it:

$ sudo hdparm --user-master u --security-unlock p /dev/sdx
security_password="p"

/dev/sdx:
 Issuing SECURITY_UNLOCK command, password="p", user=user

and disable security:

$ sudo hdparm --user-master u --security-disable p /dev/sdx
security_password="p"

/dev/sdx:
 Issuing SECURITY_DISABLE command, password="p", user=user

Now we're good:

$ sudo hdparm -I /dev/sdx
Security:
Master password revision code = 65534
          supported
  not enabled
  not locked
  not frozen

Hidden Data Areas ‡

I asked hdparm's creator, Mark Lord, whether ATA SECURITY ERASE wipes hidden data areas like the host protected area (HPA) and device configuration overlay (DCO) by default:

The answer is manufacturer-specific, and only manufacturers know the exact details. However, the idea is that the SECURITY ERASE command (which is handled totally by the drive firmware itself, not Linux) is supposed to erase everything possible inside the drive. Including HPA, DCO, spare sectors, all drive firmware settings, etc. Think of it as the modern-day "low-level format" command.

To explicitly disable HPA and DCO, use hdparm -N and hdparm --dco-restore:

# hdparm -N /dev/sdb
/dev/sdb:
max sectors   = 78125000/78165360, HPA is enabled


# hdparm -N p78165360 /dev/sdb
/dev/sdb:
setting max visible sectors to 78165360 (permanent)
max sectors   = 78165360/78165360, HPA is disabled

# hdparm --dco-identify /dev/sdb
/dev/sdb:
DCO Revision: 0x0001
The following features can be selectively disabled via DCO:
           Transfer modes:
                                udma0 udma1 udma2 udma3 udma4 udma5
           Real max sectors: 78165360
           ATA command/feature sets:
                                AAM HPA


# hdparm --dco-restore /dev/sdb
/dev/sdb:
Use of --dco-restore is VERY DANGEROUS.
You are trying to deliberately reset your drive configuration back to
the factory defaults.
This may change the apparent capacity and feature set of the drive,
making all data on it inaccessible.
You could lose *everything*.
Please supply the --yes-i-know-what-i-am-doing flag if you really want this.
Program aborted.


# hdparm --yes-i-know-what-i-am-doing --dco-restore /dev/sdb
/dev/sdb:
issuing DCO restore command

Footnotes

• †-From the terminal: sudo pm-suspend or echo -n mem > /sys/power/state. Toby Ovod-Everett shares that hot plugging SATA drives may also unfreeze them - check UEFI/BIOS for support or try eSATA. And David Clayton reminds us that AHCI must be enabled for SATA hotplugging to function.
• ‡-HDAT2 offers an "Auto Remove Hidden Areas" function as well.

Source: http://tinyapps.org/docs/wipe_drives_hdparm.html