DataLocker Sentry K350 User manual

Sentry K350 hardware encrypted USB flash drive - User Guide
User Guide
Sentry K350
FIPS 140-2 level 3
Common Critera Certified
Encrypted USB Flash Drive
© 2021 DataLocker Inc. All rights reserved. 1

Sentry K350 hardware encrypted USB flash drive - User Guide
Contents
At A Glance 4
Introduction ................................................ 4
General operation of the encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
UpdatingYourDevice.......................................... 4
AbouttheK350 .............................................. 4
Getting Started 5
1. Press the power button for 3 seconds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2. Create and confirm your password, follow the screen instructions . . . . . . . . . . . . . . 5
3.Connectandstartworking ..................................... 6
General Usage Best Practices - Password, Battery, IP67 . . . . . . . . . . . . . . . . . . . . . . 6
K350 features and configurations 7
ConnectSelectionMenu ........................................ 7
AccessingtheConfigurationMenu .................................. 8
ChangePassword ............................................ 9
SetUser................................................... 9
SafeConsole................................................ 10
SelfDestruct................................................ 11
ZeroizeDrive................................................ 12
StrongPassword.............................................. 12
PasswordLength ............................................. 12
Auto-LockTime .............................................. 13
Read-OnlyMode............................................. 13
KeypadPreference ........................................... 13
Registering Your K350 to SafeConsole 14
Using a SafeConsole Managed Device 15
UnlockinginSafeConsoleMode.................................... 15
LockingYourManagedK350...................................... 16
StandaloneLogins ............................................ 17
PasswordReset .............................................. 18
UnlockingInRead-OnlyMode..................................... 19
ChangingtheUnlockMessage .................................... 19
Scanning your Device for Malware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
© 2021 DataLocker Inc. All rights reserved. 2

Sentry K350 hardware encrypted USB flash drive - User Guide
UsingZoneBuilder............................................. 21
Reformat Using DataLocker Control Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Sanitize................................................... 21
DeviceInformation............................................ 22
Formatting Your K350 23
Selecting the Correct File System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
FormattingYourK350onWindows................................... 23
FormattingYourK350onmacOS.................................... 25
Linux Compatibility and Configuration 26
Product Specifications 28
Getting Help 28
Document Version 29
Notices 30
Disclaimer ................................................. 30
Patents................................................... 30
FCCInformation ............................................. 30
© 2021 DataLocker Inc. All rights reserved. 3

Sentry K350 hardware encrypted USB flash drive - User Guide
At A Glance
Introduction
Congratulations on your purchase of the DataLocker Sentry K350 hardware encrypted USB flash
drive.
Although the K350 is designed with user friendliness at its core, it is recommended that you review
this guide to ensure that you become fully acquainted with your K350 and make the most of all of
its features.
General operation of the encryption
Your K350 utilizes a hardware encryption engine to encrypt and decrypt data that you store on
the device. When your device is powered on, you will authenticate with the onboard system using
your password to enable the encryption and then plug into the host and use your data. When you
lock, power off or disconnect your device, the data is stored in an encrypted state.
Updating Your Device
Updated software and documentation are freely available for download at our website:
• Latest device updates - http://datalocker.com/device-updates
• Documentation and support - https://support.datalocker.com
About the K350
The K350 is a password protected, FIPS 140-2 Level 3 certified and Common Criteria cPP certified
device1, encrypted USB drive featuring a screen that streamlines setup and operation. If the K350
is centrally managed, additional layers of organizational control strengthen the portable storage
security posture further. Meet the strictest requirements and work with ease anywhere there is
USB mass storage. The K350 is the slim and strong addition to DataLocker’s complete portfolio of
securely managed solutions, plus it’s backed by a limited 3-year warranty.
1The K350 has been designed for FIPS 140-2 Level 3 and is being tested by an accredited NIST lab. The product is in
process for certification and is officially listed by NIST. K350 is also in process to achieve Common Criteria cPP certification.
© 2021 DataLocker Inc. All rights reserved. 4

Sentry K350 hardware encrypted USB flash drive - User Guide
Getting Started
1. Press the power button for 3 seconds
2. Create and confirm your password, follow the screen instructions
Press quickly on the number button to navigate all characters available on the button. Pick a
proper password.
Note: Linear and repetitive passwords are not supported and passwords must contain a MINIMUM
of 8 characters. It is recommended that you use a combination of letters, numbers and special
characters for your password. Some examples of invalid passwords are: ‘78901234’, ‘43210987’,
’12345678’, ‘1111111’
© 2021 DataLocker Inc. All rights reserved. 5

Sentry K350 hardware encrypted USB flash drive - User Guide
3. Connect and start working
• Select MENU to access all settings, such as enabling a user login. A white background with
black text on a selection denotes the current selection.
• To start working with your data in a regular way confirm CONNECT selection and plug the
drive into the host USB port as shown on the screen.
• The encryption is automatic. The K350 locks when it is unplugged from the host.
General Usage Best Practices - Password, Battery, IP67
• Use a strong password, keep it to yourself and be sure to remember it. Remote password
resets can be enabled if the device is managed by SafeConsole. If the device is not man-
aged, but there is both a Admin and User role active, the Admin can assist the User to reset
their password (while retaining the stored data).
• Only connect the K350 to USB ports. The K350 draws the correct amount of current (50mA)
from the USB port to charge the integrated Lithium-Ion battery even while in use. If the battery
within the device is low, charge it by plugging it into a USB port for 30 minutes before using
the drive. If the device is left unused for several months the battery will drain slowly. K350
can also be unlocked using solely the power from the USB-port, should there be an unlikely,
unexpected, battery issue.
• The K350 is IP67-rated but must be completely dry before connecting to a computer.
© 2021 DataLocker Inc. All rights reserved. 6

Sentry K350 hardware encrypted USB flash drive - User Guide
K350 features and configurations
Connect Selection Menu
After unlock the Connect Selection Menu is displayed.
Connect Selection Menu Overview
•CONNECT - Connect to the host computer (selected in the above example)
•READ-ONLY - Connect the device storage as read-only to the host.
•BOOT MODE - Boot an installed operating system from the device storage.
•MENU - Access the Configuration Menu
When the device is managed by SafeConsole the following two options may appear.
•SAFECONSOLE - See the section Unlocking in SafeConsole Mode
•STANDALONE - If the SafeConsole administrator allows it, the user can utilize Standalone Logins
temporarily when unlocking on systems that do not allow the management system control.
© 2021 DataLocker Inc. All rights reserved. 7

Sentry K350 hardware encrypted USB flash drive - User Guide
Accessing the Configuration Menu
In the Connect Selection you will select and confirm MENU to get to the Configuration Menu.
Login Mode Selection
The contents of the Configuration Menu will depend on the login mode of the current login, the
following login modes may be available:
•ADMIN - The login mode allows full configuration control on the device, see Configuration
Menu Overview.
•USER - The User menu is available after creating a user in the administrator menu.
In the example below part of the Admin Configuration Menu options are displayed.
Configuration Menu Overview
Menu Option Details Login Mode
Change Password Change current login password. USER/ADMIN
Set User Configure a user profile for use on your K350. ADMIN
SafeConsole Used to enable SafeConsole functionality for your
K350.
ADMIN
Self Destruct Used to configure self-destruct counters and methods. ADMIN
Zeroize Drive Zeroize the device. ADMIN
Strong Password Enable various options for increasing password
strength.
ADMIN
Password Length Set the acceptable minimum password length. ADMIN
Auto-lock Time Modify length of time before your device auto-locks. USER/ADMIN
Read-Only Mode Enable or disable forced read-only mode. ADMIN
Keypad Preference Set letters to appear first on password entry. ADMIN
© 2021 DataLocker Inc. All rights reserved. 8

Sentry K350 hardware encrypted USB flash drive - User Guide
Change Password
Available for Login USER/ADMIN
This menu option changes the current password.
1. From the Configuration Menu, select and confirm Change Password.
2. Enter the new password and confirm with the Enter-button.
3. Re-enter the password, confirm with the Enter-button.
4. Upon successful completion, the device goes back to the Configuration Menu.
Set User
Available for ADMIN
This allows the administrator to either Enable or Disable a user role. When a user is created your
K350 will show a login mode selection screen upon the next power up. If User is selected upon
login, your K350 will force the user to create a user unlock password. The user will use this password
to unlock the device. The K350 user has a limited feature set compared to the administrator, see
Configuration Menu Overview.
NOTE: The User profile is not available if SafeConsole is enabled for your K350.
Step-by-step Process to Set User
1. From the Configuration Menu, select and confirm Set User.
2. Select Enable and confirm with the Enter-button. In the example ‘DISABLE’ is selected.
Figure 1: Set User
3. Confirm with the Enter-button. Upon successful completion, the device goes back to the
Configuration Menu.
Step by step process for USER configuration
1. Power on K350.
2. Confirm login mode User (the default selection when the Set User is enabled) with the Enter-
button when prompted to select login mode.
© 2021 DataLocker Inc. All rights reserved. 9

Sentry K350 hardware encrypted USB flash drive - User Guide
3. Press Enter-button to proceed from the “Please create your password” screen.
4. Enter the new password and confirm with the Enter-button.
5. Re-enter the password to confirm with the Enter-button.
6. Select and confirm Connect.
Access User data as an Admin
1. Power on.
2. Select Admin login mode, confirm selection with Enter-button, unlock with the admin pass-
word.
3. Connect. User data is accessible on the private partition.
Assist a user who forgot their password
The scalable method for remote password resets with an audit trail is available when managing
K350 with SafeConsole. If the K350 is not centrally managed and a User is activated, the following
procedure can be used.
1. User forgets the password.
2. Power off/on. Select login mode Admin, unlock with admin password.
3. Enter Configuration Menu and select Set User, select and confirm Disable. Power off/on.
4. Select login mode Admin, unlock again with Admin password.
5. Enter Configuration Menu and select Set User, select and confirm Enable. Power off/on.
6. Select login mode User, enter and confirm the new User password. Connect to confirm and
access your data.
SafeConsole
Available for ADMIN
NOTE Once the device is connected to SafeConsole it will be permanently set to managed state. It
is not possible to return to an unmanaged state after the device once has become fully managed.
This option enables SafeConsole management for your K350. SafeConsole is a central manage-
ment console used to optionally manage K350 devices. Managed K350s require a Connection
Token upon initialization. The SafeConsole Connection Token is obtained by the System admin-
istrator through the Quick Connect Guide, located inside of the SafeConsole user interface.
SafeConsole requires a device license for activation. License sold separately.
Users without access to a Management Server, please contact sales: [e-mail]
SafeConsole offers several key features including audit logging, anti-malware services (license
sold separately), remote password reset, and more!
Enabling SafeConsole
1. From the Configuration Menu, Select SafeConsole, confirm with Enter.
2. Select Enable, confirm with Enter. The device goes back to the Configuration Menu.
3. Power off/on.
4. See Registering your K350 to SafeConsole to complete registration.
© 2021 DataLocker Inc. All rights reserved. 10

Sentry K350 hardware encrypted USB flash drive - User Guide
Self Destruct
Available for ADMIN
The self destruct action helps prevent brute force attacks by triggering when an individual inputs
an incorrect password too many times. This feature allows the administrator to set a threshold
of incorrect password attempts for the K350 before the self destruct occurs. The administrator
can also configure the self destruct to destroy the data, encryption keys, and settings OR destroy
the device (and data) when the defined number of allowed password attempts is reached. The
default number of allowed password attempts is 10 and can be increased up to 50 but not lower
than 10. When enabling the feature, there are two types of self destruct options to select. Please
refer to the below table for more details.
NOTE: Incorrect password attempts from both users and administrators are calculated cumula-
tively towards the incorrect password attempts self destruct counter. The counter will reset upon a
correct password attempt.
A. Destroy Data (default selection) - Your device is wiped completely and all device data, encryp-
tion keys, passwords are destroyed and cannot be recovered. The device needs to go through
the initialization process again.
B. Destroy Device - Your device is killed completely and all device data, encryption keys, pass-
words are destroyed and cannot be recovered. The device CANNOT be initialized again, the
destruction is permanent.
Deleted asset A.Destroy Data (default) B.Destroy Device
Administrator Password Deleted Deleted and K350 destroyed
User Password Deleted and Disabled Deleted and K350 destroyed
Configuration by administrator (menus) Kept Deleted and K350 destroyed
1. In the Configuration menu select Self Destruct, confirm with Enter-button.
2. Select CHANGE or CANCEL to change the maximum allowed incorrect password entries, the
default is 10.
3. Confirm with Enter-button.
4. Enter the number of attempts you want, between 10-50. Confirm with Enter-button.
5. Select the destruction target, DATA or DEVICE, confirm with Enter-button.
6. The device goes back to the Configuration Menu after confirmation.
Brute-Force Self-Destruct Sequence
The message “Incorrect Password”, along with the current incorrect password count, will scroll
across the screen each time an incorrect password attempt is made. Press Enter-button to display
device information or press any other button to return to the password entry screen.
After each 5 consecutive incorrect password attempts, the device will power off. Pressing the
Power button will allow the user to continue entering passwords.
Provided a limit of attempts that is set to 10, after 7 and 8 consecutive incorrect password attempts,
the message “Brute Force detected! All data will be deleted.” will scroll across the screen. After
the 9th attempt, the message “Self Destruct will begin with next failed login” will scroll across the
screen.
Once the 10th consecutive incorrect password attempt has been made, the device will display
“Hack detected. All data has been deleted.” The device will then power off by pressing any
button. At this stage either the data and/or device has been destructed. If the data is the target
© 2021 DataLocker Inc. All rights reserved. 11

Sentry K350 hardware encrypted USB flash drive - User Guide
you must now follow the getting started process as shown in the Getting Started and the formatting
your K350 section of this manual.
Zeroize Drive
Available for ADMIN
This feature allows the administrator to zeroize the drive. Performing this action deletes all the data,
removes the user and administrator passwords. The Data Encryption Key (DEK) will also be wiped
and regenerated.
NOTE: Zeroize will not remove the configurations set by the administrator.
How to Zeroize your K350
1. In the Configuration menu select Zeroize Drive, confirm with Enter-button. When your device
asks for “Zeroize Drive” select Yes, confirm with Enter-button. Selecting No will cancel the
Zeroize process.
2. Select Yes, confirm with Enter-button. Selecting No will cancel the Zeroize process.
3. When your K350 shows the “Confirm Delete all drive data?” prompt, select Yes, confirm with
Enter-button. Selecting Cancel will cancel the Zeroize process.
4. Upon successfully completing the Zeroize process, you will see “Please initialize and reformat
the drive”, confirm with Enter-button to continue.
NOTE: You must now follow the getting started process as shown in the Getting Started and the
Formatting your K350 section of this manual.
Strong Password
Available for ADMIN
This feature allows the device administrator to enable the password requirement to be stronger
than the default for both ADMIN and USER. When enabled the passwords must have at least one
letter, one number and one special character.
1. In the Configuration Menu select/confirm Strong Password.
2. Select Enable or Disable, confirm with Enter-button. The device goes back to the Configura-
tion Menu after the confirmation.
Password Length
Available for ADMIN
The device administrator can use this feature to set the minimum required password length. It can
be set between the minimum of 8 to a maximum of 64. Tapping Default will reset the counter to “8”.
1. In the Configuration Menu select/confirm Password Length.
2. Select Change or Cancel, confirm with Enter-button.
3. Enter the new minimum password length number, between 8 and 64. Confirm with Enter-
button, the device goes back to the Configuration menu after the confirmation.
© 2021 DataLocker Inc. All rights reserved. 12

Sentry K350 hardware encrypted USB flash drive - User Guide
Auto-Lock Time
Available for ADMIN/USER
This feature is disabled by default but can be enabled by the administrator and the user. Auto-lock
will disconnect the drive once it is idle (i.e. zero activity) for the configured amount of time. The
amount of idle time required to time out the device is configurable from 10 to 720 minutes.
To enable auto-lock, follow these steps:
1. Select Auto-Lock Time from the Configuration Menu, confirm with Enter-button.
2. Confirm Enable-selection with Enter-button.
3. Enter the desired number of minutes the device can remain unlocked and idle, confirm with
Enter-button. The device goes back to the Configuration menu after the confirmation.
Read-Only Mode
Available for ADMIN
Administrators can select the Read-Only Mode to globally enforce the K350 to always unlock in
read-only mode. Enabling this option will also enforce read-only access for the User profile (if the
user profile is enabled). Once the Read-Only Mode is enabled, data can only be read from the
K350 and no data can be written or modified.
To enable Read-Only Mode, follow these steps:
1. Select Read-Only Mode feature from the Configuration Menu, confirm with Enter.
2. Confirm Enable-selection with Enter-button. The device goes back to the Configuration menu
after the confirmation.
NOTE: The administrator and the user can each set Read-Only Mode for a single login by select-
ing/confirming Read-Only Mode in the Connect Selection Menu after entering their password. The
Read-Only Mode in the Configuration Menu will enforce this functionality for every login.
Keypad Preference
Available for ADMIN
Administrators can select the Keypad Preference for the device passwords. Having alphabetical
first can positively lead to the users selecting more complex passwords, rather than a numbers
based password.
To select Keypad Preference, follow these steps:
1. Select Keypad Preference feature from the Configuration Menu, confirm with Enter.
2. Confirm Enable-selection with Enter-button to have the buttons input lead with the alphabet-
ical characters, such as ABC2 rather than the defaul 2ABC.
© 2021 DataLocker Inc. All rights reserved. 13

Sentry K350 hardware encrypted USB flash drive - User Guide
Registering Your K350 to SafeConsole
Before registering your drive to SafeConsole, make sure SafeConsole is enabled on your K350.
For more information, see Enabling SafeConsole. The registration process will begin by allowing
the device to communicate with the SafeConsole server. The steps needed to register a K350 to
SafeConsole will depend on the policies that your SafeConsole administrator is enforcing. Not all
options will be shown.
A SafeConsole Connection Token will be needed. The SafeConsole Connection Token is obtained
by the SafeConsole administrator through the Quick Connect Guide and is usually sent via email.
Users without access to a Management Server, please contact sales: [e-mail] /
[phone]
1. Power on and unlock. Select Connect. Your K350 will show a “Waiting. . . ” prompt.
2. On your computer, double-click the “Unlocker” CD drive under “Devices and Drives”.
3. Upon launch, the “Device Setup” screen should appear.
4. Enter the SafeConsole Connection Token provided by your SafeConsole administrator and
confirm the EULA. Click Activate.
5. Your device will connect to the SafeConsole server.
6. Optionally Enabled Policies - These policies may or may not be enabled by your SafeConsole
administrator. They will appear during device registration if they have been enabled.
© 2021 DataLocker Inc. All rights reserved. 14

Sentry K350 hardware encrypted USB flash drive - User Guide
• Confirm Ownership of the device: Enter the Windows username and password that is associ-
ated with the login credentials of the computer the device is plugged into.
• Custom Device Information: Required information about you or your device. The required
fields will vary.
• Unique User Token: This token is directly associated with the end user’s account and will be
provided by the SafeConsole administrator usually via email.
• Administrator Registration Approval: The SafeConsole administrator may require their ap-
proval to proceed with device registration.
7. Select your desired file system from the “Format” prompt. Click Continue. See Selecting the
Correct File System.
8. After formatting, your device will show the “Control Panel”. See Using a SafeConsole Man-
aged Device for more information.
NOTE: The “Unlocker” client will generate a Password Recovery Code after your next device un-
lock. It is recommended that your device be disconnected and reconnected to ensure your
Password Recovery Code is saved to the SafeConsole.
Using a SafeConsole Managed Device
Unlocking in SafeConsole Mode
Once the K350 is registered to SafeConsole, the Secure Volume can be accessed by following the
steps below:
1. Log into your K350. Your K350 will show a “Waiting. . . ” prompt.
2. Select the option Unlocker.exe inside of the Unlocker partition that can be found in File Ex-
plorer.
3. Click the Unlock button shown on the DataLocker Unlocker screen.
4. The private partition, also referred to as Secure Volume, will be mounted to a separate drive
letter on your workstation. The Secure Volume can also be accessed by clicking the Folder
Icon in the DataLocker Control Panel.
© 2021 DataLocker Inc. All rights reserved. 15

Sentry K350 hardware encrypted USB flash drive - User Guide
Locking Your Managed K350
Lock your device when you are not using it to prevent unwanted access to your secure files on the
drive. You can manually lock the device or you can set the device to automatically lock after a
specified period of inactivity.
NOTE: If a file or application is open when the device tries to auto-lock, it will not force the appli-
cation or file to close.
Manually Locking your K350
1. Click Lock in the bottom left-hand corner of the DataLocker Control Panel to safely lock your
device. You can also use the keyboard shortcut: CTRL + L (Windows only), or right click the
DataLocker Icon in the system tray and click Lock Device.
2. Unplug K350.
NOTE: Managed devices will automatically lock during use if an administrator remotely disables the
device. You will not be able to unlock the device until the SafeConsole administrator re-enables
the device. The lock mechanism is forced and will not wait on the host system to release the
device.
Setting your K350 to Automatically Lock
You can configure the device to automatically lock using the K350 on device Configuration Menu
(See Auto-Lock Time) or by using the Control Panel. If enforced by your SafeConsole administrator,
you may be unable to modify this feature. Follow the below steps to configure this automatic lock
using the Control Panel.
NOTE: Changing this setting in the Control Panel will be reflected on the K350 onboard menu and
vice versa.
© 2021 DataLocker Inc. All rights reserved. 16

Sentry K350 hardware encrypted USB flash drive - User Guide
1. Click Preferences in the left sidebar.
2. Click the Checkbox for auto-locking the device and set the time-out to one of the following
time intervals: 5, 15, 30, 60, 120, or 180 minutes.
Standalone Logins
Requesting Standalone Logins
Standalone mode allows the Secure Volume of the K350 to be accessed by any computer that
has support for removable storage without running the Windows Unlocker application. Standalone
mode is controlled by a policy that is set by your SafeConsole administrator. If this mode is not
available, please contact them to enable this feature. SafeConsole administrators will define the
maximum allowed times your K350 can be unlocked in Standalone mode before the device needs
to be returned to a Windows computer to check-in.
To request Standalone logins, perform the following steps on a workstation that has a valid con-
nection to the SafeConsole server:
1. Unlock K350 and select Connect, confirm with Enter-button. Your K350 will show a “Waiting. . . ”
prompt.
2. Select the option Unlocker.exe inside of the Unlocker partition that can be found in File Ex-
plorer.
3. Click the Unlock button shown on the DataLocker Unlocker screen.
4. Select the Standalone tab.
5. Select the reason for the request or enter a custom reason. This information will be sent to the
SafeConsole administrator.
6. Click the Request button. You will receive the maximum number allowed.
Note: The Request automatically checkbox can optionally be enabled by your SafeConsole ad-
ministrator. When checked, the Control Panel will automatically request the maximum allowed
Standalone logins after unlocking on a Windows workstation with a valid connection to SafeCon-
sole.
© 2021 DataLocker Inc. All rights reserved. 17

Sentry K350 hardware encrypted USB flash drive - User Guide
Using Standalone Logins
On the next unlock of your K350, you can select Standalone after you input your password to un-
lock in Standalone mode. When in Standalone mode, the Unlocker partition will not be mounted
to the host computer and the DataLocker Control Panel will not need to be executed.
1. Power on.
2. Select Standalone at the “Login Mode” prompt, confirm with Enter-button.
3. Confirm with Enter-button when you are prompted with the number of remaining Standalone
logins.
4. Select Connect, confirm with Enter-button to utilize the secure partition.
NOTE: This will decrease the Currently Available count of Standalone logins by one.
To continue to use your K350 in the normal SafeConsole mode, select SafeConsole in step 2.
Note: The Currently Available number of Standalone logins will be reset to zero if a SafeConsole
administrator remotely disables or factory resets your K350. Currently available will also be set back
to zero after a password reset or when the device is blocked by GeoFence.
Password Reset
If your K350 cannot be unlocked due to a forgotten password, a recovery password can be sent
by your SafeConsole administrator.
1. Power on K350 and input the recovery password.
© 2021 DataLocker Inc. All rights reserved. 18

Sentry K350 hardware encrypted USB flash drive - User Guide
2. Once the password is entered, the K350 will prompt to change the password.
3. The password should be changed to something secure. For more information see Getting
Started
NOTE: Each password recovery code can only be used once. Your K350 must be unlocked in
SafeConsole Mode with a valid connection to SafeConsole before a new password recovery code
can be generated. Failure to do so could cause loss of access to the device and the data on it if
the password is forgotten again.
Unlocking In Read-Only Mode
You can unlock your device in a read-only state so that files cannot be altered on your secure
drive. For example, when using an untrusted or unknown computer, unlocking your device in
Read-Only Mode will prevent any malware on that computer from infecting your device or modi-
fying your files. Managed devices can be forced to unlock in a read-only state by an administrator.
When working in this mode, the DataLocker Control Panel will display the text Read-Only Mode.
In this mode, you cannot perform any operations that involve modifying files on the device. For
example, you cannot reformat the device or edit files on the drive.
To unlock your device in Read-Only Mode through the Control Panel:
1. Unlock K350 and select Connect, confirm with Enter-button. Run the Unlocker.exe.
2. Check the Read-Only Checkbox below the Unlock button.
3. Click Unlock. The DataLocker Control Panel will appear with the text Read-Only Mode at the
bottom.
To unlock the device in Read-Only Mode from the device:
1. Unlock K350.
2. In the connection selection menu select/confirm READ-ONLY MODE.
NOTE: Unlocking in “Read-Only Mode” from the connection menu also works in Standalone mode.
Changing the Unlock Message
The Unlock Message is custom text that displays on the Unlocker Screen when you unlock the
device. This feature allows you to customize the message is displayed. For example, adding clas-
sification labels can help identify which documents can be saved to the device due to company
policy. Your SafeConsole administrator can set a pre-defined message or prevent the K350 user
from changing this message.
To change the Unlock Message:
1. In the DataLocker Control Panel, click Settings on the menu bar.
2. Click Preferences in the left sidebar.
3. Type the message text in the Unlock Message field. The text must fit in the space provided
(approximately 7 lines and 200 characters).
© 2021 DataLocker Inc. All rights reserved. 19

Sentry K350 hardware encrypted USB flash drive - User Guide
Scanning your Device for Malware
If enabled by your SafeConsole administrator, the Malware Scanner is a self-cleaning technology
that detects and quarantines malware on your device. Powered by the McAfee® anti-virus and
anti-malware signature database, and constantly updated to combat the latest malware threats,
the scanner first checks for the latest updates, scans your device, then reports and cleans any
malware that is found.
Your system administrator may require the anti-malware definition to be updated before the de-
vice can be unlocked. In this event, the full anti-malware definition will need to be downloaded to
a temporary folder on the local computer before the password can be entered. This can increase
the time it takes to unlock the device based on the host computer’s networking connection and
the size of malware updates needed.
Some things to know about scanning your device:
• The scanner runs automatically when you unlock your device.
• It scans all onboard files (compressed and uncompressed).
• It will report and delete any detected malware.
• (Optional) If your SafeConsole has enabled quarantine, it may quarantine any malware it
finds. See Restoring or Deleting a Quarantined File for more information.
• The scanner will automatically update itself before each scan to protect you from the latest
malware threats.
• An update requires an internet connection. Ensure a minimum of 135 MB of free space on
the device to accommodate the downloaded malware signature files.
• Your first update may take a long time to download, depending on your internet connection.
• The date of the last update is displayed in the Control Panel.
• If the scanner becomes too far out of date, it will need to download a large file to bring it
back up-to-date.
Restoring or Deleting a Quarantined File
If your SafeConsole administrator has enabled quarantine, you will have the option of restoring
or deleting detected malware. This process helps when McAfee® detects a valid document as
malware.
NOTE: Depending on the size of infected files, quarantine may not be available. If the file cannot
be quarantined it will be deleted and will not be able to be restored using the following process.
If a file is detected as infected a warning dialog will be shown with the option to lock the drive
at that time. Quarantined files remain on the device in an encrypted state to prevent further
execution.
To view quarantined files:
1. Unlock your device and click Settings in the DataLocker Control Panel.
2. Click Quarantine on the left sidebar.
Selecting a file from the list will display additional details including, Threat Name, Threat Type, anti-
malware definition version, and the date of quarantine. After the file is selected files can either be
Restored or Deleted.
Restored files will be exempt from automatic scanning while the device is currently unlocked. The
file will be scanned during the next unlock or if a manual scan is selected from the Anti-Malware
© 2021 DataLocker Inc. All rights reserved. 20