Skip to content 
TCG Opal
In brief
TCG Opal is a specification of the Trusted Computing Group for self-encrypting drives (SEDs), mainly in notebooks and PCs. It defines how a drive encrypts data in hardware, locks storage areas, and releases access only after authentication. For IT decommissioning, TCG Opal is relevant because Opal drives enable cryptographic erasure – and because locked Opal drives without credentials can be used only to a limited extent.
How TCG Opal works
An Opal drive automatically encrypts all data with an internal key. When the lock is active, the drive releases the data only after a password is entered or via management software, often even before the operating system starts (pre-boot authentication). Important functions of the Opal specification, currently in versions 2.x:
| Function | Purpose |
|---|---|
| Hardware encryption | Encryption by the drive controller without load on the processor |
| Locking ranges | Parts or the entire drive can be locked separately |
| Key change | New key makes old data unreadable (Crypto Erase) |
| PSID Revert | Reset using the PSID printed on the label; resets the drive and erases the data cryptographically |
TCG Opal in decommissioning
For erasure, Opal offers a quick route: the key is replaced, and the data is unreadable afterward. How reliable this is depends on the manufacturer's implementation. After vulnerabilities in the hardware encryption of individual SSDs became known, for example BitLocker uses software encryption by default. Many erasure methods therefore combine the key change with further steps and a check. More on this in the guide Securely erasing hard drives and SSDs. Second IT erases SSDs with Blancco and issues a digitally signed erasure certificate for each device. Data carriers that cannot be erased are destroyed in-house in accordance with DIN 66399.
Frequently asked questions about TCG Opal
How do I recognize an Opal drive?
By the manufacturer's data sheet or entries such as "TCG Opal 2.0" or "SED". Management and diagnostic programs also display the supported functions.
What is a PSID Revert?
A reset using the physical security ID (PSID) printed on the drive. It unlocks the drive for reuse and erases all data cryptographically in the process.
Is Opal encryption enough as data protection when handing devices over?
Not on its own. For handover you need documented erasure for each drive. Encryption makes this easier but does not replace the documentation.
What is pre-boot authentication on Opal drives?
When the lock of an Opal drive is active, it releases the data only after a password is entered or via management software. This often happens even before the operating system starts. This process is called pre-boot authentication.
What is the difference between TCG Opal and BitLocker?
With TCG Opal, the drive encrypts the data itself in hardware. BitLocker is the encryption of Windows. After vulnerabilities in the hardware encryption of individual SSDs became known, BitLocker uses software encryption by default.
Erase encrypted drives securely – with documentation.
Send us your device list. You will receive your offer in 48 hours on average.