IronKey ENTERPRISE S250 User manual

Last Updated: July15, 2016
IR ONK E Y™ ENTERPRISE S250/D250
User Guide

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 2
CONTENTS
QUICK START ................................................................................................3
ABOUT MY DEVICE........................................................................................7
How is it different than a regular flash drive?..........................................................................................................7
What systems can I use it on?.....................................................................................................................................9
How secure is it?..............................................................................................................................................................9
Product specifications.................................................................................................................................................. 11
Recommended best practices ................................................................................................................................... 11
USING MY DEVICE........................................................................................12
Setting up the device................................................................................................................................................... 12
Unlocking and locking the device ............................................................................................................................. 13
Accessing my device if I forget my password.......................................................................................................... 16
Changing my password................................................................................................................................................ 16
Accessing my secure files............................................................................................................................................ 17
Encrypting and decrypting files................................................................................................................................ 17
Creating a secure backup of my files...................................................................................................................... 17
Updating my device...................................................................................................................................................... 18
Reformatting my device............................................................................................................................................... 19
Using my device on Linux ........................................................................................................................................... 19
Finding information about my device....................................................................................................................... 21
Using onboard applications........................................................................................................................................ 21
Importing digital certificates...................................................................................................................................... 23
Using Identity Manager .............................................................................................................................................. 24
Managing my online account settings ..................................................................................................................... 25
WHERE CAN I GET HELP? ..........................................................................27
For more information................................................................................................................................................... 27
To contact support....................................................................................................................................................... 27
はじめに...........................................................................................................28
시작하기...........................................................................................................39
入门 ..................................................................................................................49
開始使用...........................................................................................................59
PRIMEROS PASOS .........................................................................................69
MISE EN ROUTE............................................................................................80
ERSTE SCHRITTE .........................................................................................90

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 3
Quick Start
Enterprise devices must be set up using a Windows or Mac operating system. Once set up, you
can use your device onWindows, Mac, or Linux systems. For more information about using your
device on Linux, see.
Windows & Mac Setup
Windows Vista (SP2),7 (SP1),8,8.1 or Mac OS X 10.9.x - 10.11.x
1. Plug the device into your computer’s USB port.
2. When the Device Setup window appears, follow the on-screen instructions. If this window
does not appear, open it manually:
•Windows: Start > My Computer > IronKey Unlocker > IronKey.exe
•Mac: Finder > IronKey Unlocker > IronKey
3. When Device Setup is complete, you can move your important files to the IronKeySecure
Files drive (IronKey USB drive for Mac) and they will be automaticallyencrypted.
Some Windows systems prompt to restart after you first plug in your device.You cansafely
close that prompt without restarting—no new drivers or software are installed.
Mise en route
Installation avecWindows et Mac
Windows Vista (SP2),7 (SP1),8,8.1 ou Mac OS X 10.9.x - 10.11.x
1. Branchez le périphérique sur le port USB de votre ordinateur.
2. Lorsque la fenêtre d’Installation du périphérique s’affiche, suivez les instructions à l’écran.Si
cette fenêtre ne s’affiche pas, ouvrez-la manuellement :
•Windows :Démarrer > Ordinateur > IronKey Unlocker > IronKey.exe
•Mac : Finder > IronKey Unlocker > IronKey
3. Lorsque l’installation du périphérique est terminée, vous pouvez déplacer vos fichiers impor-
tants vers le lecteur Secure Files (Fichiers sécurisés). Ils seront automatiquement cryptés.
Certains systèmes Windows vous invitent à redémarrer la première fois que vous branchez
votre périphérique.Vous pouvez fermer cette invite en toute sécurité sans redémarrer, aucun
nouveau pilote ou logiciel n’est installé.

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 4
Kurzanleitung
Geräte-Setup beiWindows und Mac
Windows Vista (SP2),7 (SP1),8,8.1 oder Mac OS X 10.9.x - 10.11.x
1. Stecken Sie das Gerät in den USB-Port Ihres Computers
2. Wenn sich das Fenster „Geräte-Setup― öffnet, folgen Sie den Anweisungen auf dem Bild-
schirm.Wenn sich dieses Fenster nicht öffnet, dann öffnen Sie es wie folgt manuell:
•Windows: Start > My Computer > IronKey Unlocker > IronKey.exe
•Mac: Finder > IronKey Unlocker > IronKey
3. Wenn das Geräte-Setup abgeschlossen ist, können Sie Ihre wichtigen Dateien auf das Lauf-
werk „Secure Files― verschieben und sie werden automatisch entschlüsselt.
Einige Windows-Systeme werden Sie zum Neustart auffordern, wenn Sie das Ihr Gerät zum
ersten Mal anschließen. Sie können diese Aufforderung sicher schließen ohne Neu zu starten
–keine neuen Laufwerke oder Software werden installiert.
Inicio rápido
Instalación enWindows y Mac
Windows Vista (SP2),7 (SP1), 8,8.1 o Mac OS X 10.9.x - 10.11.x
1. Conecte el dispositivo en el puerto USB de su equipo
2. Cuando aparezca la ventana Instalación del dispositivo, siga las instrucciones que se muestran
en pantalla. Si no aparece, ábrala manualmente:
•Windows: Inicio > Equipo > IronKey Unlocker > IronKey.exe
•Mac: Finder > IronKey Unlocker > IronKey
3. Tras finalizar la instalación del dispositivo, podrá mover sus archivos importantes a la unidad
―Secure Files‖ y estos se cifrarán de forma automática.
Algunos sistemas Windows le solicitarán que reinicie el sistema tras conectar el dispositivo
por primera vez. Puede cerrar este mensaje con seguridad sin reiniciar el equipo, no se
instalarán drivers ni software nuevo.

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 5
クイックスタート
W ind o w s および M ac のセットアップ
Windows Vista (SP2),7 (SP1),8,8.1 または Mac OS X 10.9.x - 10.11.x
1. デバイスをコンピューターのUSBポートに挿入します。
2. [デバイスのセットアップ] 画面が表示されたら、画面上の指示に従ってください。
この画面が表示されない場合は、手動で開いてください。
•Windows の場合:[スタート] > [マイ コンピューター] > [IronKey Unlocker] >
[IronKey.exe]
•Mac の場合: [セレクタ] > [IronKey Unlocker] >[IronKey]
3. デバイスのセットアップが完了したら、重要なファイルを「Secure Files」ドライブに移動
させることができ、そこで自動的に暗号化されます。
デバイスを初めて挿し込むと、Windows システムが再起動するようにプロンプトを表示
します。 新しいドライバーまたはソフトウェアがインストールされていない場合、再起動
することなくそのプロンプトを安全に閉じることができます。
빠른 시작
Windows및Mac설정
Windows Vista (SP2),7 (SP1),8,8.1 또는 Mac OSX10.9.x - 10.11.x
1. 컴퓨터 USB 포트로 장치를꽂습니다.
2. 장치 설정 창이 나타나면 화면의 지침을 따릅니다.
이창이 나타나지 않으면 다음과 같이 수동으로 엽니다.
•Windows: 시작 > 내컴퓨터 > IronKey Unlocker > IronKey.exe
•Mac: Finder > IronKey Unlocker >IronKey
3. 장치 설정이 완료되면 중요한 파일을 „Secure File‟드라이브로
이동할 수있습니 다.이동한 파일은 자동으로 암호화됩니다.
일부 Windows 시스템에서는 장치를 처음으로 꽂으면 다시
시작하라는 메시지를 표시합니다.다시 시작하지 않고 메시지를
닫아도 안전합니다.새로운 드라이버나 소프트웨어가 설치되지
않습니다.

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 6
快速入门
Windows & Mac 安装
Windows Vista (SP2),7 (SP1),8,8.1 或 Mac OS X 10.9.x - 10.11.x
1. 将设备插到电脑 USB 接口。
2. 显示设备安装窗口后，按屏幕上的说明进行操作。
如果窗口未显示，可手动将其打开：
•Windows：开始 > 我的电脑 > IronKey Unlocker > IronKey.exe
•Mac：Finder > IronKey Unlocker > IronKey
3. 设备安装完成后，可以将重要文件移动到“安全文件”驱动器中，文件会自动加密
首次插入设备后，某 Windows 系统会提示重新启动您可以放心关闭此提示，且无需 重新启动
，因为系统并未安装任何新的驱动程序或软件。
快速入門
Windows 與Mac 設定
支援系統為： Windows Vista (SP2),7 (SP1),8,8.1 或 MacOSX 10.9.x - 10.11.x
1. 將裝置連接到您的電腦 USB 連接埠。
2. 當裝置設定視窗出現時，請依照畫面上指示操作。
若此視窗並未出現，請手動開啟：
•Windows：開始 > 我的電腦 > IronKey Unlocker > IronKey.exe
•Mac：Finder > IronKey Unlocker > IronKey
3. 當裝置設定完成時，即可將您的重要檔案移至「安全檔案」裝置，接著這些檔案就會
自動加密。
部分 Windows 系統會在您第一次連接裝置後，提示您重新啟動電腦。您可以放心關 閉此提示
且無需重新啟動，因為系統並無安裝任何新的驅動程式或軟體。

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 7
About my device
The IronKey Enterprise 250 Series (S250 and D250) is designed to be the world’s most secure
USB flash drives. Now you can safely carry your files and data with you wherever you go.
Your device (once set up) will be connected to the IronKey Enterprise Management System that
manages your organization’s IronKey devices. Device applications and features are configured by
the System Administrator. Some settings that are described in this guide may not be available to
you if the administrator has not enabled them for your device.
Device features with administrative control
» Password policies
» Password Reset
» Auto-locking device
» Onboard applications
» Force Read-Only mode
» Force Update
How is it different than a regular flash drive?
Hardware Encryption
Inside your device is the IronKey Cryptochip, which protects your data to the same level as
highly classified government information. This security technology is always on and cannot be
disabled.
Password-Protected
To access your secure data, you unlock the device with a password using the Unlocker software
that is carried on the device. Do not share your password with anyone. That way, even if your
device is lost or stolen, no one else can access yourdata.

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 8
Self-Destruct Sequence
If the Cryptochip detects physical tampering by a hacker, or if a specified number of consecutive
incorrect password attempts have been entered, it can initiate a permanentself-destruct
sequence that securely erases all onboard data—sorememberyourpassword.
Anti-Malware Autorun Protection
Your device helps protect you from many of the latest malware threats targeting USB flash
drives by detecting and preventing autorun execution of unapproved programs. It can also be
unlocked in Read-Only Mode if you suspect the host computer is infected.
SimpleDevice Management
Your device includes the IronKey Control Panel, a central management area for accessing your
files, editing your preferences, changing your device password and safely locking your device.
Secure Local Backup and Data Recovery
Securely back up your secure files using the onboard Secure Backup software (Windowsonly).
The backup allows you to recover your data to a new IronKey Enterprise device in case this
one is ever lost or stolen.
Onboard Web Browsing
Surf the web through almost any network using the onboard Mozilla Firefox web browser.
Online account
Your online account allows you to use some applications and features, such as resettinga
password, updating your device software and creating data. Your online account includes the
SecurityVault. If your device is ever lost or stolen, you can easily restore your online passwords
from this encrypted online backup.
Self-Learning Password Management
Securely store and back up all your online passwords with the IronKey Identity Manager.It
allows you to automatically log into your online account to avoid keylogging spywareand
phishing attacks.
Waterproof and Tamper-Resistant
Designed to survive the extremes, the rugged metal encasing is injected with anepoxy
compound that makes it not only tamper-resistant, but waterproof to military specifications
(MIL-STD-810F).

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 9
What systems can I use it on?
» Windows
® 8.1
» Windows
® 8
» Windows
® 7 (SP1)
» Windows
®
Vista (SP2)
» Mac OS
® X (10.9.x - 10.11.x)
» Linux (2.6+)
The computer must have a USB 2.0 port for high-speed data transfer. A USB 1.1 port or
powered hub will also work, but will be slower.
Some applications are available only for specific systems:
» Windows Only
•Onboard Firefox
•Secure Backup
•Virtual Keyboard
•IronKey Identity Manager
•Device updates
•CRYPTOCard
» MacOnly
•Auto-LaunchAssistant
How secure is it?
IronKey Enterprise 250 Series has been designed from the ground up with security in mind. A
combination of advanced security technologies are used to ensure that only you can access your
data. Additionally, it has been designed to be physically secure, to prevent hardware-level attacks
and tampering, as well as to make the device rugged and long-lasting.
The IronKey Cryptochip is hardened against physical attacks such as power attacks and bus
sniffing. It is physically impossible to tamper with its protected data or reset the password
counter. If the Cryptochip detects a physical attack from a hacker, it destroys the Cryptochip
making the stored encrypted files inaccessible.
We strive to be very open about the security architecture and technology that we use in
designing and building this product. We use established cryptographic algorithms, we develop
threat models, and we perform security analyses (internal and third party) of our systems all the
way through design, development anddeployment.

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 10
DEVICE SECURITY
DataEncryptionKeys
» AES key generated by onboard Random Number Generator
» AES key generated at initialization time and encrypted with hash of user password
» No backdoors: AES key cannot be decrypted without the user password
» AES key never leaves the hardware and is not stored in NAND flash
DataProtection
» Secure volume does not mount until password is verified in hardware
» Password try-counter implemented in tamper-resistant hardware
» Once the password try-count is exceeded, the device will initiate a permanent self-destruct
sequence
» Sensitive data and settings are stored in hardware
APPLICATION SECURITY
DevicePasswordProtection
» USB command channel encryption to protect device communications
» Password-in-memory protection to protect against cold-boot and other attacks
» Virtual Keyboard to protect against keyloggers and screenloggers
The device password is hashed using salted SHA-256 before being transmitted to the device
firmware over a secure USB channel. It is stored in an extremely inaccessible location inthe
protected Cryptochip hardware. The hashed password is validated in hardware (there is no
―getPassword‖ function that can retrieve the hashed password). Only after the password is
validated is the AES encryption key decrypted.The password try-counter is also implemented in
hardware to prevent memory rewind attacks.
IDENTITY MANAGER PROTECTION
The Identity Manager and your online account work together, allowing you to back up your
online passwords to your Online SecurityVault. First, you must unlock your device using two-
factor authentication.Your passwords are securely stored in a hidden, hardware-encrypted area
inside the device (not in the file system), being first locally encrypted with 256-bit AES, using
randomly generated keys encrypted with a SHA-256 hash of your device password.All of this
data is then doubly encrypted with 128-bit or 256-bit AES hardware encryption.
When you back up your passwords online, your device performs a complicated public key
cryptography handshake with IronKey’s services using RSA 2048-bit keys. After successful
authentication, your encrypted block of password data is securely transmitted over SSL to your
encrypted Online Security Vault.

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 11
Product specifications
For details about your device, see ―Device Info‖in the Control Panel settings.
Specification
Details
Capacity*
Up to 64GB, depending on the model
Dimensions
75mm X 19mm X 9mm
Weight
0.8 oz
Waterproof
MIL-STD-810F
OperatingTemperature
0C, 70C
Operating Shock
16G rms
Hardware Encryption
•Data: 256-bit AES (CBC Mode)
•Hardware: 256-bit AES
•Hashing: 256-bit SHA
•PKI: 2048-bit RSA
FIPS Certifications
See www.ironkey.com/en-US/website/certification-and-compliance for details.
Hardware
USB 2.0 (High-Speed) port recommended, USB1.1
OS Compatibility
•Windows Vista (SP2),Windows 7 (SP1), orWindows 8,
Windows 8.1
•Mac OS X 10.9.x - 10.11
•Unlocker for Linux (2.6+, x86)
Accessibility
IronKey Control Panel is designed to be Section 508 compliant. Users
with disabilities have keyboard navigation and screen reader support.
Designed and Assembled in theU.S.A.
IronKey Enterprise devices do not require any software or drivers to be installed.
* Advertised capacity is approximate and not all of it will be available for storage. Some space is required for onboard software.
Recommended best practices
» Create an online account so that you can:
•reset a forgotten device password
•back up your Identity Manager passwords
» Lock the device
•when not in use
•before unplugging it
•before the system enters sleep mode
» Never unplug the device when the LED is on
» Never share your device password
» Perform a computer anti-virus scan before setting up the device

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 12
Using my device
Setting up the device
Enterprise devices must be set up using a Windows or Mac operating system. Once set up, you
can use your device on Windows, Mac, or Linux systems. The setup process is the same for
systems running a Microsoft Windows or Mac operating system.
1. Plug the IronKey device into your computer’s USB port. The ―Device Setup‖ screenappears.
The setup software runs automatically from a virtual DVD. This screen may not appear if
your computer does not allow devices to autorun. You can start it manually by:
•WINDOWS: Double-clicking the ―IronKey Unlocker‖ drive in ―My Computer‖ and
launching ―IronKey.exe‖.
•MAC: Opening the IronKey Unlocker drive in Finder and opening the IronKey application
in the IronKey Unlocker folder. You can install the Auto-Launch Assistant, so that
the Unlocker will automatically open when you plug in a device. See ―Installing the
Auto- Launch Assistant (Mac only)‖ on page14.
2. Type or paste the Activation Code. You should have received the code in an email
message sent from your Administrator.
3. Select a default language preference, agree to the end-user license agreement, and then click
the ―Activate‖ button.
By default, IronKey software will use the same language as your computer’s operating system.
4. Type a device password and confirm it, and then click the ―Continue‖ button.
Your password is case-sensitive and must comply with the password policy set bythe
administrator.
5. If you are prompted to provide an email address for an online account, enter it now and
click the ―Continue‖ button.
A message prompt will appear indicating that an email has been sent to you. Follow the
instructions in the email to set up your online account; this includes creating a ―secret
question‖.
Your online account is required for some security features, such as resetting a password,
updating your device software, and creating online backups of Identity Manager data.
6. Once you have set up your online account, click OK in the message prompt to proceed with
the device setup.
7. Click ―Continue". The device initializes.

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 13
During this process, it generates the AES encryption key, creates the file system for the
secure volume, and copies secure applications and files to the securevolume.
When the initialization is complete, the IronKey Control Panel appears.Your device isnow
ready to protect your data and can be used on a Windows, Mac or Linux computer. Some
policies set by the administrator may restrict use of the product to systems running only
Windows and Mac.
Installing the Auto-Launch Assistant (Mac only)
Installing the Auto-Launch Assistant will automatically open the IronKey Unlocker window when
you plug in your device on that computer. This feature is only available on a Mac.
1. Unlock your device and click the ―Settings‖ button in the menu bar.
2. On the ―Tools‖ side bar, click the ―Install Auto-Launch Assistant‖ button.
TIP:To uninstall it, click on the ―Uninstall Auto-Launch Assistant‖ button
Unlocking and locking the device
UNLOCKING THE DEVICE
The unlock process is the same for Windows and Mac systems. For Linux systems, see ―Using
my device on Linux‖ on page 20.
1. Plug in your device and wait for the Unlocker window to appear.
If the Unlocker window does not appear, you can start it manually by:
•WINDOWS: Double-clicking the ―IronKey Unlocker‖ drive in ―My Computer‖ and
launching ―IronKey.exe‖.
•MAC: Opening the IronKey Unlocker drive in Finder and opening the IronKey application
in the IronKey Unlocker folder.
•NOTE: On a Mac you can install the Auto-Launch Assistant, which automatically opens
the Unlocker when you plug in an IronKey Enterprise device.
2. Type your device password and click ―Unlock". The IronKey Control Panel will appear.
•Optionally, you can click the ―Read-Only Mode‖ check box to unlock the device in Read-
Only Mode.
•Entering your password correctly (which is verified in hardware) will mount yoursecure
volume with all your secure applications and files.
•Entering the wrong password a consecutive number of times—depends on the password
settings defined by the administrator—will permanently destroy the device and allyour
onboard data.
•As a security precaution, you must unplug and reinsert the device after every three failed
password attempts.

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 14
UnlockinginRead-Onlymode
You can unlock your device in a read-only state so that files cannot be edited on your secure
drive. For example, say that you want to access a file on your device while using an untrusted
or unknown computer; unlocking your device in Read-Only Mode will prevent any malware on
that machine from infecting your device or modifying your files. Administrators can also set your
device to unlock in a read-only state.
1. Plug in your device and launch the Unlocker.
2. Click the ―Read-Only Mode‖ check box.
3. Click the ―Unlock‖ button.
» You will see a message in the Control Panel that indicates you are in Read-Only Mode.
» When you unlock your device in Read-Only Mode, you will remain in Read-Only Mode until
you lock your device.
» Some features are not available in Read-Only Mode because they require modifying files on
your device. Examples of unavailable features include reformatting, restoring applications,
editing files on the Secure Files drive, editing the Applications List, and running onboard
Firefox.
» Tounlock your device in Read-Only Mode on Linux, enter: ironkey --readonly
Changing the Unlock message
This feature, if enabled by the System Admin, allows you to create a message that appears on the
IronKey Unlocker window.For example, you can provide contact information so that if you lose
your device someone will know how to return it to you.
1. Unlock your device and click the ―Settings‖ button in the menu bar.
2. Click the ―Preferences‖ button in the left sidebar.
3. Enter text in the ―Unlock Message‖ field.
Your message text must fit the space provided (approximately 7 lines and 200 characters).
LOCKING THE DEVICE
•Click the ―Lock‖ button in the bottom left of the Control Panel to safely lock your
device.You can also use the keyboard shortcut: CTRL + L. If you want the device to
automatically lock when not in use, see ―Setting the device to automatically lock‖ on page
16.
NOTE: If you have applications or files open on the Secure Files drive, you might not be able to
lock your device (this prevents potential file corruption). Close any open onboard applications
and files and retry locking the device.
NOTE:An administrator can remotely disable your device if necessary. Disabling an unlocked
device will automatically lock the device.You cannot unlock the device unless the SystemAdmin
re-enables the device.
CAUTION: Once the device is locked, you can safely unplug it. However, do not unplug the
device when it is unlocked.

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 15
Setting the device toautomaticallylock
If enabled by your System Admin, you can set a device time-out to automatically lock your
device after a specified period of inactivity. This will help prevent others from accessing your
secure files.
1. Unlock your device and click the ―Settings‖ button in the menu bar.
2. Click the ―Preferences‖ button in the left sidebar.
3. Click the checkbox for auto-locking the device and set the time-out for either 5, 15, 30, 60,
120, or 180 minutes.
If a secure file has been opened, it may not be safe to lock the device; otherwise, you may lose
the file changes or corrupt the file.The device will continue to try to lock in this situation, but
will not force the application to quit.You can configure the setting to force the device to lock;
however, you risk losing data in any opened and modified files.
IMPORTANT: Forcing a device to lock can result in data loss. If your files have become
corrupt from a forced lock procedure or from unplugging the device before locking, you might
be able to recover the files by running CHKDSK and using data recovery software.
To run CHKDSK (Windows only)
1. Unlock the device.
2. Use the following keyboard shortcut to bring up the ―Run‖ prompt:
WINDOWS LOGO BUTTON + R.
3. Type ―CMD‖ and press ENTER.
4. From the command prompt, type CHKDSK, the Secure files drive letter,
and then ―/F /R‖.
For example, if the Secure Files drive letter is G, you would enter:
• CHKDSK G: /F /R
5. Use data recovery software if necessary in order to recover your files.
TYPING PASSWORDS WITHTHE VIRTUAL KEYBOARD
If you are unlocking your device on an unfamiliar computer and are
concerned about keylogging and screenlogging spyware, use the IronKey
Virtual Keyboard. It helps protect your device password by letting you
click out letters and numbers. The underlying techniques in theVirtual
Keyboard will bypass many trojans, keyloggers, and screenloggers.
You can start the Virtual Keyboard in a couple of ways:
1. Click the Virtual Keyboard icon in a password field on the IronKey Unlocker orControl
Panel.The Virtual Keyboardappears.
•Alternatively, when the keyboard focus is in a password field you can press CTRL+ALT+V.
2. Click the keys to type your password. Click ―Enter‖ when you are finished.

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 16
•You can use theVirtual Keyboard in conjunction with the actual keyboard, so that you
type some characters and click some characters.
•You can also optionally click the ―Randomize‖ button to randomize where the keys are
located. This helps protect against screenloggers.
NOTE:This feature is available on Windows only and uses a standard QWERTY keyset. The
language preference for the device must be set to English.
NOTE:When you click a key in the Virtual Keyboard, all of the keys briefly go blank. This
feature prevents screenloggers from capturing what you clicked. If you do not want to use this
feature, you can disable it in the options menu beside the ―Close‖ button.
Accessing my device if I forget my password
If you forget your password, you can reset it if an administrator has granted you password reset
privileges. Otherwise, you must contact your administrator.
1. Plug in your device and launch the Unlocker.
2. Click the ―Password Help‖ button.
3. On the Password Help prompt, click the ―Reset Password‖ button.An email will be sent to
the email address provided during account setup with instructions on how to proceed.
4. After you complete the instructions in the email message, click the ―Continue‖ button.
5. Type your new password, or use the Virtual Keyboard, and confirm the password in the fields
provided, then click the ―Change Password‖ button.
Changing my password
Password settings are determined by an administrator. Sometimes you may be required to
change your password to comply with new corporate password policies. When a change is
required, the Password Change screen will appear the next time you unlock the device. If the
device is in use, it will lock and you will have to change the password before you can unlock it.
It is also good security practice to regularly change your password on your own. However, be
especially careful to remember your devicepassword.
1. Unlock your device and click the ―Settings‖ button in the menu bar.
2. Click the ―Password‖ button in the left sidebar.
3. Enter your current password in the field provided.
4. Enter your new password and confirm it in the fields provided.
5. Click the ―Change Password‖ button.
NOTE: If you created a backup with the Secure Backup application, restoring the backup will
require you to enter the device password that was used at the time of the back up.

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 17
Accessing my secure files
After unlocking the device, you can access the files securely stored on the deviceby:
•Clicking the ―Files‖ button (folder icon) in menu bar of the IronKey Control Panel.
•WINDOWS: Opening Windows Explorer to the ―Secure Files‖ drive.
•MAC: Opening Finder to the ―Secure Files‖drive.
TIP:You can also access your files by right-clicking the IronKey icon on the Windows taskbar
and clicking ―SecureFiles‖.
Encrypting and decrypting files
Everything you store on your IronKey Enterprise device is encrypted. Since the device hasa
built-in Cryptochip, all of the encryption and decryption is done for you ―on-the-fly‖, giving you
the convenience of working as you normally would with a regular flash drive, while providing
strong and ―always-on‖security.
•Drag a file onto the Secure Files drive to automatically encrypt it.
•Files opened from the Secure Files drive are automatically decrypted as you open them.
Creating a secure backup of my files
If your device has the Secure Backup application
onboard, you can restore an encrypted backupof
your data to a new or existing
IronKey Enterprise device (Windows only,English
only).
Secure Backup saves an encrypted backup of
some or all of your onboard files to your local
computer or network fileshare.You use the same
application to restore one or all of your files.
1. In the Applications list of the IronKey Control Panel, click the ―Secure Backup‖ button to
open the program (Windows only)
•The Secure Backup window should appear, displaying the Secure Files drive.
2. Select the files you want to back up.
3. Click the check boxes next to the files you want to back up.
•A green check mark means all files in this folder and all sub-folders will be backed up
•A red minus sign means only some of the files in this folder or its subfolders will be
backed up
4. Type the path to the destination folder for the backed up files or use the Browse button to
locate it.

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 18
•The destination folder can be an existing folder, a new folder, or a separate drive (for
example, a network fileshare)
5. Click ―Backup Now". The files will be encrypted and backed up.
NOTE:While the files are securely encrypted, the filenames are not. To hide the filenames, zip
the files you want to back up before you create the backup file.
IMPORTANT: Do not add, alter,or delete the backed up files or you may be prevented from
restoring them later.
RESTORINGFILESTOTHEDEVICEFROMABACKUPFILE
1. In the Applications list of the IronKey Control Panel, click the ―Secure Backup‖ button to
open the program (Windows only).
•The Secure Backup window should appear, displaying the Secure Files drive.
2. Select the ―Restore from My Computer‖ tab.
3. Select the destination folder you had chosen previously when backing up your data.
•Make sure to select the folder that contains the backup file, not files or folders within
that folder.
4. Select which files/folders to restore and click ―Restore Now‖. Restored files will overwrite
existing files of the same name on the Secure Files drive.
NOTE: If the data was backed up from a different IronKey Enterprise device, you must use the
device password for that device in order to restore the files to another device.
Updating my device
You can securely update software and firmware on your device through signed updates that are
verified in hardware. Keeping your device up-to-date helps protect you from future malware
and online threats. If enabled for your device by an administrator, you will receive an update
notification when a new update becomes available. You must update your device within the
time period indicated in the message. If you do not update your device within the time allowed,
access to your files may be restricted to read-only until you update your device.
1. Unlock your device and click the ―Settings‖ button on the menu bar of the IronKey Control
Panel.
2. Click the ―Tools‖ sidebar and in the Updates section, click the ―Check for Updates‖ button.
3. If an update is available, click ―Download‖ to install it.
NOTE:You must use a computer running Windows to download and install software updates.
TIP:You can check for updates automatically each time you unlock your device by clicking the
―Automatically check for updates‖ check box. If your administrator has already set this option,
the check box will appear enabled and dimmed.

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 19
Reformatting my device
Reformatting the Secure Files drive will erase all your secure files and your Application List, but
it will not erase your device password and settings.
1. Unlock your device and click the ―Settings‖ button in the menu bar.
2. Click the ―Reformat SecureVolume‖ button.
TIP: Back up your data prior to reformatting; otherwise, it will be erased.
Using my device on Linux
You can use your IronKey Enterprise device on several distributions of Linux (x86 systems
only with kernel version 2.6+). However, you must set up the device using a Windows or Mac
operating system. Some policies set by the administrator may restrict use of the productto
systems running only Windows andMac.
USING THE UNLOCKER
Use the Unlocker for Linux to access your files and change your device password on Linux,
allowing you to securely transfer files from and betweenWindows, Mac, and Linux computers.
Depending on your Linux distribution, you might need root privileges to use the program
―ironkey‖ found in the Linux folder of the mounted virtual DVD. If you have only one IronKey
Enterprise device attached to the system, run the program from a command shellwith no
arguments (e.g. ironkey). If you have multiple IronKey Enterprise devices, you must specify
which one you want to unlock.
NOTE: ironkeyonly unlocks the secure volume; it must then be mounted. Many modern Linux
distributions do this automatically; if not, run the mount program from the command line, using
the device name printed by ironkey.
To unlock the device in Read-Only Mode,enter:
ironkey --readonly When prompted, type your password.
To unlock the device,enter:
ironkey --unlock When prompted, type your password.
To lock the device, you must either unmount and physically remove (unplug) it,or elserun:
ironkey --lock
Simply unmounting the device does not automatically lock the secure volume.
Tolock the device named“devicename,” enter:
ironkey --lock [devicename]

IRONKEY ENTERPRISE S250/D250 USER GUIDE
GE 20
Please note the following important details for using your device on Linux:
1. Kernel Version must be 2.6 or higher
If you compile your own kernel, you must include the following in it:
» DeviceDrivers->SCSIDeviceSupport-><*>SCSICDROMSupport
» DeviceDrivers-><*> Support for Host-side USB
» DeviceDrivers-><*> USB device filesystem
» DeviceDrivers-><*> EHCI HCD (USB 2.0) support
» DeviceDrivers-><*> UHCI HCD (most Intel and VIA) support
» DeviceDrivers-><*> USB Mass Storage Support
The kernels that are included by default in most major distributions already have thesefeatures,
so if you are using the default kernel that comes with a supported distribution you do not need
to take any other action.
Also, on 64-bit linux systems the 32-bit libraries must be installed in order to run the ironkey
program. Consult the distribution’s help resources for assistance and more information.
2. Mounting problems
» Make sure you have permissions to mount external SCSI and USB devices
» Some distributions do not mount automatically and require the following command to be
run:
mount /dev/<name of the device> /media/<mounted device name>
» The name of the mounted device varies depending on the distribution. The names of the
IronKey Enterprise devices can be discovered by running:
ironkey --show
3. Permissions
» You must have permissions to mount external/usb/flash devices
» You must have permissions to run executables off the device’s virtual DVD in order to
launch the Unlocker
» You might need root user permissions
See the Linux folder on the device’s virtual DVD for information about how to set up
permissions to allow non-root users to access their IronKey Enterprise devices.All of these
methods require that the system administrator take (one time) action to enable access;after
that, ordinary users can lock, unlock, and change passwords on any IronKey Enterprise devices
they plug in.
4. Supported distributions
Not all distributions of Linux are supported. Please visit http://support.ironkey.com for the
latest list of supported distributions.
5. The IronKey Unlocker for Linux only supports x86 systems at this time.