Kingston Technology IRONKEY D500S User manual

User Manual
IronKey D500S
Find the language and latest documentation here.
IronKey D500S Installation Guide
Simplied Chinese .....简体中文说明书
Traditional Chinese ....繁體中文說明
............For instructions in English
. . . . . . . . . . . . . . . . . . Para instrucciones en Español
.........Für Anleitungen in Deutsch
. . . . . . . . . . . . . . . . . . Pour des instructions en Français
. . . . . . . . . . . . . . . . . . Per le istruzioni in Italiano
............Por as instruções em Português
. . . . . . . . . . . . . . . . . . Instrukcje w jezyku Polskim
. . . . . . . . . . . . . . . . . .日本語マニュアル用

1
IRONKEY™ D500S
SECURE USB 3.2 Gen 1 FLASH DRIVE
User Guide

Contents
Introduction ....................................................................................................................................................................... 3
D500S features .............................................................................................................................................................................. 4
About this manual ......................................................................................................................................................................... 4
System requirements .................................................................................................................................................................... 4
Recommendations ............................................................................................................................................................... 5
Using the correct file system ......................................................................................................................................................... 5
Usage reminders ........................................................................................................................................................................... 5
Best practices for password setup ................................................................................................................................................ 6
Setting Up My Device .......................................................................................................................................................... 7
Device access (Windows environment) ............................................................................................................................................ 7
Device access (macOS environment) ................................................................................................................................................ 7
Device Initialization (Windows & macOS environment) ....................................................................................................... 8
Password selection ......................................................................................................................................................................... 9
Virtual keyboard ......................................................................................................................................................................... 11
Password visibility toggle ........................................................................................................................................................... 12
Admin & User passwords .............................................................................................................................................................. 13
Dual partitions………………………………………………………………………………………………………………………………………………………………………………………..15
Contact information ...................................................................................................................................................................... 16
Device Usage (Windows & macOS environment) ............................................................................................................... 17
Login for Admin & User (Admin enabled) ...................................................................................................................................... 17
Login for User-Only mode (Admin not enabled) ............................................................................................................................. 17
Unlocking in Read-Only mode ...................................................................................................................................................... 18
Brute-Force Attack protection ...................................................................................................................................................... 19
Accessing my secure files ............................................................................................................................................................. 19
Device Options ................................................................................................................................................................... 20
D500S Settings ................................................................................................................................................................... 22
Admin settings .............................................................................................................................................................................. 22
User settings: Admin enabled ........................................................................................................................................................ 23
User settings: Admin not enabled ................................................................................................................................................. 24
Changing and saving D500S settings .............................................................................................................................................. 25
Admin Features ................................................................................................................................................................. 26
User password reset ..................................................................................................................................................................... 26
Login password reset (for User password) ..................................................................................................................................... 26
One-Time recovery password ........................................................................................................................................................ 27
Crypto-erase password ................................................................................................................................................................................... 29
Force Read-Only User data ............................................................................................................................................................ 31
Help and Troubleshooting .................................................................................................................................................. 32
D500S lockout ............................................................................................................................................................................... 33
D500S device reset ....................................................................................................................................................................... 34
Drive letter conflict (Windows operating systems) ......................................................................................................................... 35
Error messages ............................................................................................................................................................................. 36
Device Usage (Linux environment)...…………………………………………………………………………………………………………………………………………37

3
Figure 1: IronKey D500S
Introduction
The Kingston IronKey D500S is a military-grade security USB drive that builds on the features which made IronKey
well-respected to safeguard sensitive information. It is FIPS 140-3 Level 3 (pending) certified which includes new
security enhancements from NIST requiring secure processor upgrades for added security. Encryption and decryption
is done on the D500S, with no trace left on the host system – making it immune to password sniffers in memory.
Along with hardware-based XTS-AES 256-bit encryption, it also features a rugged zinc casing that is waterproof*,
dustproof*, crush-resistant and sealed with epoxy to protect internal components from penetration attacks.
D500S supports Multi-Password (Admin, User, One-Time Recovery and Crypto-Erase) options with traditional Complex
or Passphrase modes**. The Multi-Password option enhances the ability to recover access to the data if one of the
passwords is forgotten. In addition to supporting traditional Complex passwords, the Passphrase mode allows for a
numeric PIN, sentence, list of words, or even lyrics from 10 to 128 characters long. Admin can enable a User, create
custom sized dual data partitions separating Admin/User login files, enable a One-Time Recovery password, Crypto-
Erase password, and reset the User password to restore data access.
To aid in password entry, the “eye” symbol can be enabled to reveal the typed-in password, reducing typos
leading to failed login attempts. For added peace of mind, D500S uses a digitally-signed firmware making it immune to
BadUSB malware, and Brute Force password attack protection to prevent password guessing. Brute Force attack
protection locks out User or One-Time Recovery passwords upon 10 invalid passwords entered in a row, and crypto-
erases the drive if the Admin password is entered incorrectly 10 times in a row.
To protect against potential malware on untrusted systems, both Admin and User can set Read-Only mode to write-
protect the drive; additionally, the built-in virtual keyboard shields passwords from keyloggers or screenloggers***.
Small and medium businesses can use the Admin role to locally manage their drives, e.g. use Admin to configure or
reset employee User or One-Time Recovery passwords, recover data access on locked drives, and comply with laws and
regulations when forensics are required.
D500S offers many customization options and is TAA/CMMC compliant and assembled in the USA.
D500S is backed by a limited 5-year warranty with free Kingston technical support.
* Please refer to datasheet’s specification. Product must be clean and dry before use.
** Passphrase mode not supported on Linux systems.
*** Virtual Keyboard: Only supports US English on supported Microsoft Windows and macOS systems.

4
IronKey D500S features
• FIPS 140-3 level 3 (Pending) certified with XTS-AES 256-bit hardware encryption (encryption can never be
turned off)
• Brute Force and BadUSB attack protection
• Multi-Password options
• Complex or Passphrase password modes
• Unique Dual-Partition option and Crypto-Erase Password
• Eye button to display entered passwords to reduce failed login attempts
• Virtual keyboard to help protect against keyloggers and screenloggers
• Forced/Session based Read-Only (write protect) settings to protect drive contents against changes or
malware
• Small and medium businesses can locally manage drives using the Admin role
• Windows, macOS and Linux compatible (consult datasheet for details)
About this manual
This user manual covers the IronKey D500S and is based on the factory image with no implemented customizations.
System requirements
PC platform
• Intel, AMD & Apple M1 SOC
• 15MB free disk space
• Available USB 2.0 - 3.2 port
• Two consecutive drive letters after the last
physical drive*
*Note: See ‘Drive letter conflict’ on page 35.
PC operating system support
• Windows 11
• Windows 10
Mac platform
• 15MB free disk space
• USB 2.0 - 3.2 Port
Mac Operating System support
• macOS X (v. 10.15.x – 13.x)
Linux platform
• 5MB free disk space
• USB 2.0 - 3.2 Port
Linux operating system support
• Linux Kernel v4.4+

5
Recommendations
To ensure there is ample power provided to the D500S device, insert it directly into a USB port on your notebook or
desktop, as seen in Figure 1.1. Avoid connecting the D500S to any peripheral device(s) that may feature a USB port,
such as a keyboard or USB-powered hub, as seen in Figure 1.2.
Figure 1.1- Recommended Usage
Figure 1.2- Not recommended
Using the correct file system
The IronKey D500S comes preformatted with the FAT32 file system. It will work on Windows, macOS and Linux*
systems. However, there could be some other options that could be used to format the drive with manually, such as
NTFS for Windows and exFAT. You can reformat the data partition if needed but data is lost when the drive is
reformatted.
Usage reminders
To keep your data safe, Kingston recommends that you:
• Perform a virus scan on your computer before setting up and using the D500S on a target system
• When using the drive on a public, or unfamiliar system, you may wish to set the Read-Only mode on the device
to help protect the drive from malware
• Lock the device when not in use
• Eject the drive before unplugging it
• Never unplug the device when the LED is lit. This may damage the drive and require a reformat, which will erase
your data
• Never share your device password with anyone
Find the latest updates and information
Go to kingston.com/support for the latest drive updates, FAQs, documentation, and additional information.
NOTE: Only the latest drive updates (when available) should be applied to the drive. Downgrading the drive to an
older software version is not supported and can potentially cause a loss of stored data or impair other drive
functionality. Please contact Kingston Technical Support if you have questions or issues.
* The D500S does not support out-of-box initialization on Linux and will need to be fully initialized and configured on
a supported Windows or macOS system before the drive can be used on Linux. Additional information can be found
in the Linux section of this user guide on page 37

6
Best practices for password setup
Your D500S comes with strong security countermeasures. This includes protection against Brute Force attacks that
will stop an attacker guessing passwords by limiting each password attempt to 10 retries. When the drive’s limit is
reached, D500S will automatically wipe out the encrypted data – formatting itself back to a factory state.
Multi-Password
D500S supports Multi-Passwords as a major feature to help protect against data loss if one or more passwords are
forgotten. When all password options are enabled, the D500S can support three different passwords you may use to
recover data – Admin, User, and a One-Time Recovery password.
D500S allows you to select two main passwords – an Administrator password (referred to as Admin password) and a
User password. The Admin can access the drive at any time and set up options for the User – the Admin is like a
Super User. In addition, the Admin can set up the One-Time Recovery password for the User to provide a way for the
User to log in and reset the User password.
The User can access the drive as well, but compared to the Admin has limited privileges. If one of the two passwords
is forgotten, the other password can be used to access and retrieve the data. The drive can then be set back up to
have two passwords. It is important to set up BOTH passwords and save the Admin password in a safe location while
using the User password. The User can use the One-Time Recovery password in order to reset the User password
when needed.
If all passwords are forgotten or lost, there is no other way to access the data. Kingston will not be able to retrieve
the data as the security has no back doors. Kingston recommends that you have the data also saved on other media.
The D500S can be Reset and reused, but the prior data will be erased forever.
Password modes
The D500S also supports two different password modes:
Complex
A complex password requires to meet a minimum of 8-16 characters using at least 3 of the following characters:
• Upper case alphabet characters
• Lower case alphabet characters
• Numbers
• Special characters
Passphrase
D500S supports Passphrases from 10 to 128 characters. A Passphrase follows no rules, but if used properly, can
provide very high levels of password protection.
A Passphrase is basically any combination of characters, including characters from other languages. Like the D500S
drive, the password language can match the language selected for the drive. This allows you to select multiple words,
a phrase, lyrics from a song, a line from poetry, etc. Good passphrases are among the most difficult password types
to guess for an attacker yet may be easier to remember for users.

7
Setting Up My Device
To ensure there is ample power provided to the IronKey encrypted USB drive, insert it directly into a USB 2.0/3.0 port
on a notebook or desktop. Avoid connecting it to any peripheral devices that may feature a USB port, such as a
keyboard or USB-powered hub. Initial setup of the device must be done on a supported Windows or macOS based
operating system.
Device access (Windows environment)
Plug the IronKey encrypted USB drive into an available USB port on the notebook or desktop and wait for Windows to
detect it.
• Windows 10/11 users will receive a device
driver notification. (Figure 3.1)
Figure 3.1 – Device Driver Notification
• Once the new hardware detection is
complete, select the option IronKey.exe
inside of the Unlocker partition that can be
found in File Explorer. (Figure 3.2)
• Please note that the partition letter will vary
based on the next free drive letter. The drive
letter may change depending on what
devices are connected. In the image below,
the drive letter is (E:)
Figure 3.2 – File Explorer Window/IronKey.exe
Device access (macOS environment)
Insert the D500S into an available USB port on your notebook or desktop and wait for the Mac operating system to
detect it. When it does, you will see an ‘IRONKEY’ volume appear on the desktop. (Figure 3.3)
• Double-click the IronKey CD-ROM icon
• Then, double-click the IronKey.app
application icon found in the window
displayed in Figure 3.3. This will start the
initialization process.
Figure 3.3 – IronKey Volume

8
Device Initialization (Windows & macOS Environment)
Language and EULA
•
• Select your language preference from the drop-
down menu and click Next (Figure 4.1)
Figure 4.1 – Language Selection
•
Review the license agreement and click Next.
Note: You must accept the license agreement
before continuing; otherwise, the Next button
will remain disabled. (Figure 4.2)
Figure 4.2 – License Agreement

9
Device Initialization
Password selection
On the Password prompt screen, you will be able to create a password to protect your data on the D500S using
either the Complex or Passphrase password modes (Figures 4.3- 4.4). Additionally, the Multi-password Admin/User
options can also be enabled on this screen. Before proceeding with password selection, please review Enabling
Admin/User Passwords below for a better understand of these features.
Note: Once either Complex or Passphrase mode is chosen, the mode cannot be changed unless a device is reset.
To begin with password selection, create your password in the ‘Password’ field, then re-enter it in the ‘Confirm
Password’ fields. The password you create must meet the following criteria before the initialization process will
allow you to continue:
Complex Password
• Must contain 8 characters or more (up to
16 characters.)
• Must contain three (3) of the following
criteria:
o Upper Case
o Lower Case
o Numerical Digit
o Special characters (!,$,&, etc..)
Figure 4.3 – Complex Password
Passphrase Password
• Must contain:
o 10 characters minimum
o 128 characters maximum
Figure 4.4 – Passphrase Password
Password hint (optional)
A password hint can be useful for providing a
clue as to what the password is, should the
password ever be forgotten.
Note: The hint CANNOT be an exact match to
the password.
Figure 4.5 – Password Hint Field

10
Device Initialization
Valid and invalid passwords
For valid passwords, the password criteria Boxes will highlight green when the criteria are met. (See Figures 4.6a-b)
Note: Once the minimum of three password criteria are met, the fourth criteria box will become gray, indicating
that this criterion is not optional (Figure 4.6b)
Figure 4.6a – Complex Password Condition Met
Figure 4.6b – Complex Password Condition Optional
For invalid passwords, the Password Criteria Boxes
will highlight red and the Next button will be disabled
until the minimum requirements are met.
This applies to both Complex and Passphrase
Passwords.
Figure 4.7 – Password Conditions Not Met

11
Device Initialization
Virtual keyboard
The D500S features a virtual keyboard that can be used for Keylogger protection.
• To utilize the Virtual Keyboard, locate the
keyboard button on the upper-right side of the
Device Initialization screen and select it.
Figure 4.8 – Activating the Virtual Keyboard
• Once the virtual keyboard appears, you may also
enable Screenlogger Protection. When using this
feature, all the keys will briefly go blank. This is
expected behavior, as it prevents screenloggers
from capturing what you’ve clicked.
• To make this feature more robust, you may also
choose to randomize the virtual keyboard by
selecting randomize in the lower-right of the
keyboard. Randomize will arrange the keyboard
in a random order.
Figure 4.9 – Screenlogger Protection / Randomize

12
Device Initialization
Password visibility toggle
By default, when you create a password, the password string will be shown in the field as you type it in. If you wish
to ‘hide’ the password string as you type, you can do so by toggling the password ‘eye’ located on the upper-
righthand side of the Device Initialization window.
Note: After the device has been initialized, the password field will default to ‘hidden’.
To hide the password string, click the gray icon.
Figure 4.10 – Toggle ‘hide’ Password
To show the hidden password, click the blue icon.
Figure 4.11 – Toggle ‘show’ Password

13
Device Initialization
Admin and User passwords
By enabling Admin and User passwords, you can leverage multi-password functionality, in which the Admin role can
manage both accounts. Selecting ‘Enable Admin and User passwords’ allows for an alternative method of drive
access in case one of the passwords is forgotten.
With Admin and User passwords enabled, you can also access:
• Dual-Partition configuration
• One-Time Recovery password
• Forced read-only mode for User login
• User password reset
• Force Reset password for User login
• Crypto-Erase password
To learn more about these features, navigate to page 25 within this user guide.
• To Enable Admin and User passwords
click on the box next to ‘Enable Admin
and User Passwords’ and select Next
once a valid password has been chosen.
(Figure 4.12)
• If this feature is enabled, then the
chosen Password at this screen will be
the Admin Password. Click Next to
proceed to the User Password screen
where a password is chosen for the User.
Figure 4.12 – Enabling Admin and User Passwords
Note: Enabling Admin and User passwords is optional.
If the drive is set up with this feature NOT enabled (box unchecked), then the drive will be configured as a Single
User, Single Password drive without any Admin features. This configuration will be referred to User-Only mode
throughout this manual.
To proceed with a Single User, Single Password setup, keep Enable Admin and User Passwords unchecked, and
click Next after creating a valid password.
Note: ‘Admin and User Passwords’ will be referred to as ‘Admin Role’ for the remainder of this guide.

14
Device Initialization
Admin and User Passwords
• If Admin Role was enabled in the
previous screen, the following screen
will prompt for the User Password
(Figure 4.13) The User Password will
have limited capabilities compared to
Admin and will be discussed in further
detail later in this User Guide (see Page
23)
Figure 4.13 - User Password (Admin and User Enabled)
Note: The chosen Password Option (Complex or Passphrase) criteria will carry over to the User Password, One-Time
Password Recovery, Crypto-Erase Password and to any password resets that are needed after the drive is set up.
The chosen password option may only be changed after a full device reset.
•
• The ‘Require password reset on next
login’ feature on the bottom left corner
of Figure 4.13 is only for the User
Password and can be enabled to force
the User to login using the temporary
password set by Admin during the
initialization process, and then change it
to a password of their choice after the
drive is authenticated with the
temporary password. This is useful when
the drive is given to another person to
use. (Figure 4.14)
Note: For security, the new password
cannot be the same as the temporary
password.
Figure 4.14 - Require password reset on next login
(For User Password)

15
Device Initialization
Dual partitions
The IronKey D500S allows you to create two
custom sized, separate partitions between the
Admin & User. If this feature is enabled, the Admin
login will have access to both User & Admin
partitions, while the User login will only have
access to the User Partition. This feature is useful
for securely separating data and file access
privileges between the Admin & User, or can be
used to enable a hidden file store to prevent
exposing un-needed files on untrusted systems.
The partition sizes between the Admin & User can
also be adjusted if desired.
NOTE: This feature is optional and can be disabled by
leaving the “Enable Dual Partition” box unchecked
during setup (Figure 4.15)
Figure 4.15- Partition device
To adjust and allocate the partition sizes between
User & Admin, move the slider to the left or right
respectively (Figure 4.16).
• Partitions can be adjusted in 0.5GB
Increments.
• Partition sizing is based on the total capacity of
the available storage on the hidden partition.
• By default, the Dual partition slider is set to
divide storage evenly between Admin & User,
until it is manually adjusted.
• The smallest partition size that can be
allocated is 1GB.
Figure 4.16- Partition device, slider adjusted
Admin Login
Once the drive is fully setup with Dual Partitions
enabled, the Admin Login will be presented with
an option to unlock the drive to access either the
Admin Partition OR the User Partition with each
successful login. (Figure 4.17)
NOTE: Only one partition can be opened at a time.
Both User & Admin partitions cannot be unlocked
at the same time.
The User Login will not be presented with this
option and will automatically unlock the User
Partition only.
Figure 4.17- Admin login example, partition selection

16
Device Initialization
Contact information
Enter your contact information into the text boxes provided (see Figure 4.18)
Note: The information you enter in these fields may NOT contain the password string you created in Step 3.
However, these fields are optional and can be left blank, if so desired.)
The ‘Name’ field may contain up to 32
characters, but cannot contain the
exact password.
The ‘Company’ field may contain up to
32 characters, but cannot contain the
exact password.
The ‘Details’ field may contain up to
156 characters, but cannot contain the
exact password.
Figure 4.18 - Contact information
Note: Clicking ‘OK’ will complete the initialization process and proceed to unlock, then mount the secure partition
where your data can be securely stored. Proceed to unplug the drive and plug it back into the system to see the
reflected changes.

17
Device Usage (Windows & macOS Environment)
Login for Admin & User (Admin enabled)
If the device is initialized with Admin and User Passwords (Admin role) enabled, the IronKey D500S application will
launch, prompting for the User Password login screen first. From here you can login with the User Password, view
any entered contact information, or Login as Admin (Figure 5.1). By clicking on the ‘Login as Admin’ button (shown
below) the application will proceed to the Admin Login menu where you can login as Admin to access the Admin
settings and features (Figure 5.2) .
Figure 5.1 - User Password Login (Admin enabled)
Figure 5.2 - Admin Password Login
Login for User-Only Mode (Admin not Enabled)
As mentioned previously, although it is
recommended to use the Admin role functionality to
get the full benefit of your device, the IronKey drive
can also be initialized in a User-Only (Single
Password, Single User) configuration. This is an
option for those who would like a simple, single
password approach to securing the data on your
drive. (Figure 5.3)
Note: To enable Admin and User passwords, use the
Reset Device button to put the drive back into the
initialization state where you can enable Admin and
User passwords. ALL data on the drive will be
formatted and lost forever when a Reset Device
occurs.
Figure 5.3 - User Password Login (Admin not enabled)

18
Device Usage
Unlocking in Read-Only Mode
You can unlock your drive in a read-only state so that files cannot be altered on your IronKey drive. For example,
when using an untrusted or unknown computer, unlocking your device in Read-Only Mode will prevent any
malware on that computer from infecting your device or modifying your files.
When working in this mode, you cannot perform any operations that involve modifying files on the device.
For example, you cannot reformat the device, restore, add, or edit files on the drive.
To unlock the device in Read-Only Mode:
1. Insert the device into the USB port of the
host computer and run the file
IronKey.exe.
2. Check the Read-Only Mode below the
password entry box (Figure 5.4).
3. Type your device password and click
Login. The device will now be unlocked in
Read-Only mode.
Figure 5.4- Read-Only Mode
If you wish to unlock the device with full read/write access to the secure data partition, you must shutdown the
D500S and log back in, leaving the ‘Read-Only Mode’ checkbox unchecked
Note: The D500S Admin options features a Forced Read-Only mode for the User data, meaning the User login can
be forced to unlock in a read-only state by the Admin (See page 31 for details).

19
Device Usage
Brute-Force attack protection
Important: During login, if an incorrect password is entered, you will be given another opportunity to enter the
correct password; however, there is a built-in security feature (also known as Brute Force attack protection) that
tracks the number of failed login attempts. *
If this number reaches the pre-configured value of 10 failed password attempts, the behavior will be as follows:
Admin/User Enabled
Brute Force protection
Device Behavior
(10 incorrect password attempts)
Data Erase
and
Device Reset?
User Password
Password Lockout. Login as Admin or
use One-Time Recovery password to
reset User Password
NO
Admin Password
Crypto-Erase drive, Passwords,
settings, and data erased forever
YES
One-Time Recovery Password
Password Lockout, Recovery
Password button will gray out and
become unusable. Login as Admin to
Reset Password
NO
User-Only
Single User, Single Password
(Admin/User NOT Enabled)
Brute Force protection
Device Behavior
(10 Incorrect Password attempts)
Data Erase
and
Device Reset?
User Password
Crypto-Erase drive, Passwords,
settings, and data erased forever
YES
* Once you authenticate to the device successfully, the failed login counter will be reset in relation to which Login
method was used. Crypto-erase will delete all passwords, encryption keys and data – your data will be lost forever.
Accessing my secure files
After unlocking the drive, you can access your secure files. Files are automatically encrypted and decrypted when
you save or open them on the drive. This technology gives you the convenience of working as you normally would
with a regular drive, while providing strong, “always-on” security.
Hint: You can also access your files by right clicking the IronKey Icon in the Windows taskbar and clicking Browse
D500S (Figure 6.2)