Aegis Secure Key 3NX

User’s Manual

Remember to memorize / save your

authentication and recovery PINs in a safe
place.

Data Security at Your Fingertips

 Table of Contents
About the Aegis Secure Key 3NX  4
PIN Requirements  4 Copyright © Apricorn 2018. All rights reserved.
Battery Note  4
Windows is a registered trademark of Microsoft Corporation.
Waking the Key  5
All other trademarks and copyrights referred to are the property of their
First-Time Use  5 respective owners.
Admin Mode  5
Distribution of modified versions of this document is prohibited without
LED States and Their Meaning  6
the explicit permission of the copyright holder.
Locking the Key  6 Distribution of the work or derivative work in any standard (paper) book
Unlocking the Key  6 form for commercial purposes is prohibited unless prior permission is
obtained from the copyright holder.
Adding a New User PIN (Via Admin Mode) 7
Adding a New User PIN (Via User Forced Enrollment Mode) 7 DOCUMENTATION IS PROVIDED AS IS AND ALL EXPRESS OR
IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES,
Deleting the User PIN  8
INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,
Changing the User PIN  8 FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT,
Changing the Admin PIN  8 ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH
DISCLAIMERS ARE HELD TO BE LEGALLY INVALID
Setting One-Time-Use Recovery PINs  9
Using One-Time-Use Recovery PINs  9 Revised Nov 9, 2018
Setting Read-Only or Read / Write Modes from the Admin Mode  10
Setting Read-Only or Read / Write Modes from the User Mode  11
Setting LED Flicker / Button Press Indicator Mode  12
Setting Minimum PIN Length Requirement  12
Setting the Unattended Auto-Lock Feature  12
Setting a Self-Destruct PIN  13
Aegis Secure Key Brute-Force Protection  14
Performing a Complete Reset  15
Initializing and Formatting After a Complete Reset  16
Hibernating or Logging Off from the Operating System  17
Aegis Secure Key Setup for Mac OS  17
Diagnostic Mode  18
Removable Media / Fixed Disk 19
Lock-Override Mode 20
Troubleshooting / FAQs 21
Technical Support / Warranty  22
Quick Reference Guide  23
 Waking the Secure Key
About the Aegis Secure Key 3NX When the Secure Key is not in use, it will enter a sleep state. While in this state, the device is
locked and cannot be accessed.
To wake the key so it can accept keypad inputs, press the button once. The RED LED will
glow solidly (standby state.)
Note: If the key has never been used, the BLUE and GREEN LEDs will glow solidly indicating
that the Admin PIN must first be established before the key can be used.

Important: First-Time Use

3 DO NOT PRESS ANY BUTTONS Each Aegis Secure Key is shipped without a preset Personal Identification Number (PIN)
WHILE THE SECURE KEY IS installed on the key. A 7 to 16-digit Admin PIN must be established before the key can be
INSERTED INTO A COMPUTER used. This Admin PIN is used to set any and all of the Admin Mode Features of the key, and
USB PORT. The resulting downward can also be used to access the key’s data in User mode.
pressure exerted can damage the
NOTE: if you are using the Aegis Configurator to set up your Aegis Secure Key or
Secure Key’s USB connector and
the computer’s USB port, causing any other Apricorn secure drive, first ensure that the device to be configured has
CONFIGURABLE

both to malfunction. Enter all PINs the “configurable” logo on the back of the device and second, DO NOT perform
and command codes onto the Secure any of the the following Manual Admin and USER PIN SETUP steps below; The Aegis
Key’s keypad PRIOR to plugging the Configurator will execute these setup steps and will only recognize devices in their factory
device into the USB port for use. “out of box” state or devices that have been completely reset.

To Set Up the Admin PIN:

1. Wake up the key by pressing the button. Both the BLUE and GREEN LEDs will glow
2 1 Battery Note solidly.
2. Press + 9 at the same time. The BLUE LED will glow solidly and the GREEN LED will
The Aegis Secure Key has an internal
be blinking.
rechargeable battery with a smart-charging 3. Enter the series of numbers that you will use for the Admin PIN (See PIN requirements on p.
circuit. For safety, each key ships with a partial 4) and press the button.*
charge. Before initial use, we recommend 4. Re-enter that same PIN and press the button again. The GREEN LED will illuminate for
one second followed by the BLUE LED glowing solidly by itself.
plugging the key into a powered USB port for 5. The key is now in Admin mode and other Admin features can be set (e.g., adding a User.)
80 minutes to fully charge the battery. The 6. To exit the Admin mode, press the button or don’t press any buttons for the next 30
battery will automatically charge whenever it is seconds and the key will return to the locked standby state, indicated by a solid red LED*
GREEN LED will blink if the PIN is accepted; If the PIN is NOT accepted, the RED LED
plugged into a powered USB port, regardless of will blink-- review PIN requirements on page 4 and repeat steps 3-4 above.
its operational mode. In standby mode, the RED
LED fades in and out slowly to indicate that it’s Admin Mode
charging and glows solid RED to indicate that To set up any of the key’s Admin functions, the Admin mode must first be entered. Once in the
it’s fully charged. Note: Prior to initial setup, Admin mode, each of the key’s functions can be addressed with the appropriate button com-
mands. While in the Admin mode, the data on the key will not be accessible.
the RED LED will pulse while plugged into a
PIN Requirements Prior to your first use of the Aegis Secure Key, you must first set an Admin PIN. Immediately
powered USB port even though it may be fully after setting up your Admin PIN, you may then continue setting up other functions. If you do
PINs must be a minimum of seven
digits and a maximum of 16 digits. charged. If the battery is completely discharged, nothing for a period of 30 seconds, the key will revert to its standby state.
To re-enter the Admin mode, perform the following steps below.
Cannot contain all sequential the key will go through a self-test (indicated by a
numbers (e.g., 01234567, 9876543) 1. Press and hold + 0 for five seconds until the RED LED blinks.
RED, GREEN, and BLUE LED sequence) when
and cannot contain all of the same (This indicates that you can enter the Admin PIN.)
number (e.g., 1111111, 2222222.) plugged into a USB port. 2. Enter the Admin PIN and press the button.
Note: Sequentially, 0 occurs before 1, not after 9. 3. Admin Mode is indicated by a solid BLUE LED.
4. To exit the Admin Mode, either allow 30 seconds of inactivity or
4 press the LOCK button. 5
LED States and Their Meaning Establishing a User PIN
Slow Fading RED Battery charging (when plugged into USB port) If no additional User beyond the Admin will be permitted to access the key’s data, disregard this
page’s contents as it relates only to the “User” PIN.
No LEDs Key locked and asleep The Aegis Secure Key can have one Admin and one User, making a total of two working PINs.
Blinking RED Error / incorrect key entry; Mode Not Available; User Adding a User is a perfect way to securely share the key or deploy it for use where the User does
PIN Change not require access to the key’s Admin features. While the User has limited functionality and no
Admin rights to the key, they can still access its data, change their own User PIN, and set the key
Solid RED Locked / Standby state; Awaiting PIN entry
to Read Only or Read / Write mode.
Blinking GREEN Key-entry accepted There are two ways to establish a User PIN: Admin generated while in Admin Mode, or User
Solid BLUE / Waiting for New User or Admin PIN to be generated while in User Forced Enrollment State.
Blinking GREEN established A.) ADMIN-GENERATED USER PIN
Solid BLUE Admin Mode 1. Enter the Admin Mode by holding + 0 for five seconds; With RED LED blinking, enter the
Admin PIN and press the button. The BLUE LED will glow solidly.
Solid GREEN Key unlocked
2. Press the + 1 buttons together until the BLUE LED glows solidly and the GREEN LED
Slow Blinking BLUE Key unlocked in Lock-Override Mode starts blinking.
Solid GREEN / Key unlocked in Read-Only Mode 3. Enter the User PIN* and press . The GREEN LED will blink three times by itself, then
Slow Blinking RED the BLUE LED will glow solidly as the GREEN LED continues blinking.
Alternating Indicates a mode has been entered that can result 4. Re-enter that same User PIN and press . The GREEN LED will glow solidly for a short
RED / BLUE in the deletion of a User or the data on the key period of time (between one and three seconds) verifying that the User PIN was suc-
(depending on the mode chosen.) cessfully added, and then will be replaced by the BLUE LED glowing solidly, indicating
Also used when setting Auto-lock feature that the key has returned to the Admin mode.
One second of RED Self-test mode (automatically occurs during key B.) USER-GENERATED USER PIN (USER FORCED ENROLLMENT)
followed by one startup) ensures all components are ready and
Note: User Forced Enrollment state can only be implemented where there is no
second of GREEN working properly
Admin-generated User PIN set up as described in the process above.
followed by one
second of BLUE User Forced Enrollment Security Warning:
When a drive is in the User Forced Enrollment state, it is essentially unlocked until a User
Three Seconds of During Reset Process, indicates successful PIN is established. Therefore, DO NOT load sensitive data onto the drive if User Forced
Solid RED / GREEN resetting of cryptographic security parameters Enrollment is to be implemented.

Unlocking the Key 1. Enter the Admin Mode by holding + 0 for five seconds; With RED LED blinking, enter the
Admin PIN and press the button. The BLUE LED will glow solidly.

1. Press the button to wake the key from sleep (as described above). 2. Press 0 + 1 and the GREEN LED will blink three times, then will be replaced by BLUE
The RED LED will glow solidly. LED glowing solidly. Press the LOCK button to return the key to its locked state. The key
is now in User Forced Enrollment State, allowing a User to establish his own User PIN.
2. Enter either a User PIN or Admin PIN and press the button. If the PIN is accepted, the
GREEN LED will rapidly blink four times, then will slow down to one blink per second until USER-GENERATED USER PIN IN FORCED ENROLLMENT STATE
it’s plugged into a USB port, at which time will glow solidly. 1. Press and ensure that the BLUE and the GREEN LEDs are glowing solidly.
(If the PIN is incorrect, the RED LED will blink.)
2. Press + 1 and ensure that the BLUE LED continues glowing solidly while the GREEN
3. A blinking GREEN LED indicates that the key is unlocked and ready for use. The key is LED blinks. Enter the new User PIN* and press the button. The GREEN LED will blink
now ready to plug into a USB port and will function as an external drive. If it’s not plugged three times by itself and then will be joined by the BLUE LED glowing solidly.
into a USB port within 30 seconds, the key will lock itself and return to its sleep state.
3. Within 30 seconds, enter that same User PIN once more, and press the button again.
Locking the Key This time, the GREEN LED will glow solidly for aproximately one second, then the drive
will return to its locked state, indicated by the RED LED glowing solidly. The key’s data
Press the LOCK button. When successfully locked, The RED LED will glow solidly, indicating can now be accessed using either the User PIN or the Admin PIN.
that it’s in its standby state.
The Aegis Secure Key will not be recognized by the operating system while in its standby state.
Note: If data is still being written to the key, the Secure Key will wait until that operation is * Note: Default setting for minimum PIN length is 7 characters,
completed and then it will lock automatically. and a maximum of 16.
6 7
Deleting the User PIN Setting One-Time-Use Recovery PINs
Delete the User PIN by doing the following: The Admin has the ability to set Recovery PINs that will allow a User to access data on the
1. Enter the Admin mode. (Hold + 0 for five seconds. With the RED LED blinking, enter the Secure Key in the event of a forgotten PIN by creating a new state of User Forced Enrollment
Admin PIN and press the button.) The BLUE LED will now glow solidly. in which a new User PIN can be established without wiping any data off of the drive. The
Admin can establish up to four single-use Recovery PINs; once a Recovery PIN has been
2. Press the 7 + 8 buttons together for five seconds. The GREEN LED will blink three times and used to access the Secure Key, it will no longer be available for future recovery efforts.
then will be followed by the RED and BLUE LEDs blinking alternately. NOTE: The Recovery PIN will not unlock the device, but will place the Secure Key into a User
3. Press the 7 + 8 buttons together again for five seconds. The GREEN LED will glow solidly Forced Enrollment state, where the User can then establish a new User PIN which will then
for a second or two. grant access the Key’s data.
4. The key will return to Admin mode indicated by the BLUE LED glowing solidly. 1. Enter the Admin mode. (Hold + 0 for five seconds. With the RED LED blinking, enter the
Admin PIN and press the button.) The BLUE LED will now glow solidly.
NOTE: Deleting the User PIN will also delete the Self-Destruct PIN as well as all recovery 2. Press the + 8 buttons together. The GREEN LED will blink three times by itself, and then will
PINs (if any have been set.) be joined by a solid BLUE LED.

Changing the User PIN

3. Enter the Recovery PIN and press the button. If PIN is accepted, the GREEN LED will blink
three times.
The User PIN can be changed within the User mode (key unlocked, GREEN LED blinking) 4. Repeat by entering that same Recovery PIN and pressing the button again. If PIN is
accepted for the final time, the GREEN LED will blink three times and the Secure Key will then
*Note: The Admin PIN cannot be changed while in the User mode. The Admin PIN can only return to the Admin mode indicated by a solid BLUE LED.
be changed from within the Admin mode; See below.
You can change the User PIN by doing the following: 5. To add more Recovery PINs, repeat steps 2-4. When finished, press the button to return Key
to its Standby mode.
1. Unlock the Aegis Secure Key with the User PIN. (The GREEN LED will blink)
2. Press the + 1 buttons together for five seconds (the RED LED will blink)
3. Enter the current User PIN and press the
and the GREEN LED will blink.)
button. (The BLUE LED will glow solidly Using a One-Time-Use Recovery PIN
4. Enter the new User PIN and press the button (the GREEN LED will blink three Deploying a Recovery PIN will put the Secure Key into a state of User Forced
times, followed by the BLUE LED glowing solidly and the GREEN LED blinking.) Enrollment and that recovery PIN will no longer be useable. Additionally, once in a state
of User Forced Enrollment, the previous User PIN will no longer be recognized as a
5. Re-enter the new User PIN and press the button (the GREEN LED will glow solidly valid PIN for drive authentication and a new User PIN must be created.
for a second or two, then will return to the User mode, indicated by the GREEN LED
blinking.) 1. With the Secure Key in Standby mode, press and hold the + 7 buttons together for five
seconds and release once the RED LED starts blinking.
Changing the Admin PIN 2. Enter a recovery PIN (from Admin) and press the button. The GREEN LED will blink three
times by itself, and then will be joined by a solid BLUE LED indicating the Key is in User
Changes to the Admin PIN can only be made while the key is in the Admin mode. Forced Enrollment mode.
1. Enter the Admin mode. (Hold + 0 for five seconds – with the RED LED blinking, enter 3. Enter a new User PIN and press the button. The GREEN LED will blink three times if
the Admin PIN and press the button.) The BLUE LED will glow solidly. accepted.
2. Press + 9 together. The BLUE LED will glow solidly and the GREEN LED will blink. 4. Re-enter that same new User PIN and press the button again to verify it. If accepted, the
GREEN LED will blink three times and then the Secure Key will return to its Standby state,
3. Enter the new Admin PIN and press the button. The GREEN LED will blink
indicated by the RED LED glowing steadily. The Secure Key will now be accessible using this
three times.
new User PIN.
4. Re-enter the new Admin PIN and press the button. The GREEN LED will glow solidly for
a second or two and then return to the Admin mode, indicated by the BLUE LED glowing
solidly.

8 9
Setting Read-Only or Read / Write Setting Read-Only or Read / Write
Modes from the Admin Mode from the User Mode
With a large number of viruses and Trojans that attach themselves to USB keys, this feature NOTE: When changing Read-Only or Read / Write settings, do not make these
is especially useful if you need to access data on the key when used in a public setting. changes with the key attached to an operating system. This may cause confusion
Additionally, Read-Only is an important feature for forensic applications, where data must be within the operating system about the proper status of the key and the key may not
preserved in its original, unaltered state and can’t be overwritten or modified. function properly until the operating system has been restarted.
The Admin can set the key to a Read-Only mode for both the Admin and the User. When set This mode will allow the User to set the Read / Write status of the key, without having
by the Admin, the Admin is the only one that can change the key back to Read / Write mode. access to the Admin functions.
When the key is unlocked in Read-Only mode and inserted into a USB port, the GREEN When the key is unlocked in Read-Only mode and inserted into a USB port, the RED
LED will glow solidly and the RED LED will blink once every three seconds. LED will blink once every three seconds while the GREEN LED will glow solidly.
To set the Key to Read-Only: If the key is set to be Read-Only in the Admin mode, the User cannot override that
1. Enter the Admin mode. (Hold + 0 for five seconds – with RED LED blinking, enter the setting. Only the Admin can return the key to Read / Write Mode.
Admin PIN and press the button.) The BLUE LED will glow solidly.
2. Press and hold the r + o (7 + 6) buttons together until the GREEN LED blinks three
To Set the Key to Read-Only:
times.
1. Press the button to wake the key. The RED LED will glow solidly.
3. The key will return to Admin mode indicated by the BLUE LED glowing solidly.
2. Press the r + o (7 + 6) buttons together for three seconds.
4. Until changed, the key can only be read. The GREEN LED will blink three times.
To return the Key to Read / Write: 3. Enter the User / Admin PIN and press . The GREEN LED will blink rapidly whenever
1. Enter the Admin mode. (Hold + 0 for five seconds – with the RED LED blinking, enter the Secure Key is connected to USB port.
Admin PIN and press the button.) The BLUE LED will glow solidly. 4. The Key will be in a Read-Only state the next time it is unlocked.
2. Press and hold the r + w (7+ 9) buttons together until the GREEN LED blinks three times.
3. The key will return to Admin mode, indicated by the BLUE LED glowing solidly and the key To Return the Key to Read / Write:
will be restored to its normal Read / Write condition.
1. Press the button to wake the key. The RED LED will glow solidly.
Important Note 2. Press the r + w (7+ 9) buttons together for three seconds.
Setting the key to Read/Write from the Admin mode will globally override a Read- The GREEN LED will blink three times.

Only mode that has been set by the User. 3. Enter the User / Admin PIN and press .
The GREEN LED will glow solidly whenever the Secure Key is connected to USB port.
4. Key will return to unlocked mode and can now be written to, indicated by the blinking
GREEN LED.

Important Note
Setting the key to Read/ Write from the User mode will not override a
Read-Only setting that was placed by the Admin.
To set the key to be in Read-Only mode for both the User and the Admin, set
the Read-Only Mode using the Admin function.

10 11
Setting LED Flicker / Button Press Indicator Setting a Self-Destruct PIN
Creates a flickering effect in LED lights indicating positive button presses The Secure Key’s Self-Destruct PIN defends against physically compromising situations by
erasing the key’s contents and leaving it to look as if it never had any data written to it.
1. Enter the Admin mode. (Hold + 0 buttons for five seconds – with RED LED blinking, *USE WITH CAUTION* When this mode is activated and the key is unlocked with the Self-
enter the Admin PIN and press the button.) The BLUE LED will glow solidly. Destruct PIN, it will effectively perform a crypto-erase on the key, deleting all of its data.
2. Once in the Admin mode, press 0 + 3 together to enable LED Flicker mode. Additionally, the encryption key will be deleted and a new encryption key will be created to
take its place. When this Self-Destruct PIN is entered, the key will unlock and the GREEN
3. To disable LED Flicker mode, (while in Admin mode) press the 0 + 4 buttons together.
LED will glow solidly as if the key is being normally unlocked. The key, however, will need to
be partitioned and reformatted before it can be used again. Additionally, The previous Admin
and User codes will be deleted in the crypto-erase process and the Self-Destruct PIN will
Setting Minimum PIN Length Requirement then become the new Admin PIN to unlock the key.
The Self-Destruct feature can only be enabled or disabled by the Admin. However, the
The Secure Key’s minimum PIN length default setting is 7, however, for greater security, a Self-Destruct PIN can be generated by either the Admin or the User. If the Admin generates
longer minimum PIN setting of up to 16 characters can be implemented. the Self-Destruct PIN, only the Admin can change that PIN. If the User generates the Self-
Destruct PIN, both the User and the Admin can change the PIN.
1. Enter the Admin mode. (Hold + 0 for five seconds – with RED LED blinking, enter the Note: The Self-Destruct PIN must be different from the Admin PIN, User PIN, and
Admin PIN and press the button.) The BLUE LED will glow solidly.
Recovery PINs.
2. Press the + 4 buttons; The RED LED will blink twice.
1. By default, the Self-Destruct feature is disabled. To allow the Secure Key to be set with
3. Pressing two digits, enter the new minimum PIN length; e.g.: 08 = 8 characters, 11 = 11
a Self-Destruct PIN, Enter the Admin mode. (Hold + 0 for five seconds – while the
characters, etc.
RED LED is blinking, enter the Admin PIN and press the button.) The BLUE LED will
4. If accepted, the GREEN LED will blink three times and the Secure Key will return to the glow solidly.
Admin mode, indicated by the BLUE LED glowing solidly. If the numeric entry is below
2. Press the 7 + 4 buttons together*. The GREEN LED will blink three times and at this
07, or greater than 16, the RED LED will blink three times indicating entry error and your
point, the Self Destruct PIN can now be set by the Admin while the Key is in the Admin
command will not be accepted.
mode. If the intent is for the Self-Destruct PIN to be set up at another time by the User,
press the button and refer to the User Setting Self Destruct PIN instructions below.
Setting the Unattended Auto-Lock Feature Otherwise, continue to step 3.

To protect against unauthorized access if the key is unlocked and unattended, the Aegis 3. Press + 3 until the RED and BLUE LEDs blink alternately.
Secure Key can be set to automatically lock after a predetermined period of inactivity. In its 4. Enter the Self-Destruct PIN and press . The GREEN LED will blink three times and
default state, the Aegis Secure Key’s Unattended Auto-Lock feature is turned off. then will return to RED and BLUE LEDs blinking alternately.
The Unattended Auto-Lock can be set to activate after 5, 10 or 20 minutes of inactivity.
5. Re-enter the Self-Destruct PIN and press . The GREEN LED will glow solidly for a
To set the Unattended Auto-Lock, perform the following steps: few seconds and then will return to either the Admin mode (indicated by the BLUE LED
1. Enter the Admin mode. (Hold + 0 for five seconds – with RED LED blinking, enter the glowing solidly) or the unlocked state if created by User.
Admin PIN and press the button.) The BLUE LED will glow solidly. 6. To enable or disable the Self-Destruct PIN, enter the Admin mode and press the 7 + 4
2. Once in the Admin mode, press + 6. buttons together for a second or two; successful enablement will be indicated by three
The RED and BLUE LEDs will blink alternately. GREEN LED blinks. successful disablement of Self Destruct mode (press and hold the
7 + 4 buttons again) is indicated by three RED LED blinks.
3. Press one of the numbers below that corresponds to the amount of inactivity you would
like the key to lock itself: Self-Destruct PIN Set by the User
If the device is enabled for Self-Destruct Mode by the Admin, unlock the device with the
0 = OFF (The Default is OFF for this feature.)
User PIN and follow steps 3 - 5. Additionally, the User can change their Self-Destruct
1 = 5 minutes PIN by following these same steps. Note that the mode can’t be enabled or disabled in
the User mode.
2 = 10 minutes
3 = 20 minutes
4. After you have entered the desired amount of allowable inactivity, the GREEN LED will
blink three times indicating command acceptance, and then will return to the Admin
mode, indicated by the BLUE LED glowing solidly.

12 13
Aegis Secure Key Brute-Force Protection Performing a Complete Reset
What is Brute-Force Attack? There may be circumstances (forgotten PIN, redeployment, return to factory default settings)
when you need to completely reset the key. The complete reset feature will perform a crypto-
A Brute-Force Attack is a means of breaching a cryptographic data defense scheme by
erase on the key, generate a new encryption key, delete all users and formatting, and will
systematically running an astronomical number of decryption possibilities. With AES 256
return all of the settings to factory default.
having never been cracked, the data stored on a Secure Key is going to be more than
well-protected against brute-force. But brute-force attacks aren’t necessarily aimed at the To perform a complete reset of the key, do the following:
bulk of the data itself, but rather, at the drive’s access PINs. After all, PINs are usually
the weakest links of any data protection plan, and as such, PINs are essentially all that a 1. Press and hold + LOCK + 2 together for ten seconds.
brute-force attack needs to decrypt. The default number of maximum incorrect PIN entries The RED and BLUE LEDs will blink alternately.
allowed is 20, but can be programmed to be as few as four.
2. The GREEN and RED LEDs will glow solidly for several seconds, followed by the
Brute-Force Protection GREEN LED glowing solidly for several seconds, followed finally by the GREEN and
BLUE LEDs glowing solidly which indicates that the reset is complete.
3. A new Admin PIN will need to be entered and the key will need to be reformatted before
1. After three unsuccessful drive authentication attempts, the Aegis Secure Key will it can be used again.
automatically add additional time delays to each subsequent try thereafter. The RED
LED will blink the number of failed attempts after three, all the way up to the halfway
point of total allowed attempts, e.g. 10 total programmed attempts; halfway point is 5.
2. Once that halfway point of the number of unsuccessful authentication attempts is
reached, the keypad will lock up and the RED LED will blink at a rate of three flashes
per second. No additional PIN attempts will be recognized.
3. To unlock the keypad and regain the ability to enter a PIN, press and hold the 5 button
and the button together until the RED and GREEN LEDs blink alternately.
4. Enter the code “LastTry” (5278879) and press the button. The RED LED will glow
steadily. --You will now have the remaining 50% of PIN attempts.
5. When the key is successfully unlocked, the Brute-Force counter will return to zero.
The number of attempts possible, both before and after the LastTry (5278879) code is
entered, can be set (in Admin Mode) between two and ten attempts.
Setting the before/after attempts to the minimum of two would allow for a total of four
attempts (two before entering the LastTry code and two after.)
To program the number of Brute-Force attempts allowed:
1. Enter the Admin mode. (Hold + 0 for five seconds – with the RED LED blinking, enter
the Admin PIN and press the button.) The BLUE LED will glow solidly.
2. Press and hold the + 5 button for three seconds.
The RED LED will double-blink.
3. Press the number of before/after attempts desired on the numeric keypad ( 2 - 9 .)
The GREEN LED will blink the same number of times to correspond to the number
you have entered (for example: the 8 button will result in eight blinks, and yield eight
attempts before the LastTry code and another eight attempts after, yielding a total
of 16.) To return the key to its default setting, press the 1 then 0 keys to change the
number back to ten attempts.

Note: The number of before and after attempts are the same, i.e., 4 before / 4 after,
8 before / 8 after, etc.

14 15
Formatting the Aegis Secure Key Hibernating, Suspending, or
After a Complete Reset Logging Off from the Operating System
A complete reset of the Aegis Secure Key will erase all information and partition Be sure to save and close all the files on your Aegis Secure Key before hibernating,
settings. After a complete reset, you will need to reformat the Aegis Secure Key. suspending, or logging off from the Windows operating system.
1. After a complete reset, press + 9.
2. Enter the new Admin PIN and press the UNLOCK button. If accepted, the It is recommended that you lock the Aegis Secure Key manually before hibernating,
GREEN LED will quickly blink three times, then return to the BLUE LED glowing suspending, or logging off from your system.
solidly and the GREEN LED blinking.
3. Re-enter the Admin PIN and press the button. If accepted, the GREEN LED
To log off the Aegis Secure Key, double-click Safely Remove Hardware on the
will be solid for two seconds.
Windows desktop and remove the Aegis Secure Key from your computer.
4. The BLUE LED will glow solidly for 30 seconds (or until the LOCK button is
pressed, which will return the key to its standby state.)
Attention: To ensure the data integrity of your Aegis Secure Key, be sure to lock or
5. The Admin PIN is now set and will allow access to the key or the Admin
log off your Aegis Secure Key if you are:
features.
• Away from your computer
6. To unlock the key, enter the new Admin PIN and press .
• Using the switching user function by sharing a computer with others
7. Inset key into USB port.
8. A prompt window will ask you if you want to format the drive.
Select the Format Disk button.

*In iOS, the prompt window will read,

“The disk you inserted was not readable by this computer” Aegis Secure Key Setup for Mac OS ®

click the Initialize button and follow the Setup for Mac OS instructions on next
page.
Your Aegis Secure Key is pre-formatted in FAT32 for compatibility on the widest
range of systems. To reformat the key to a Mac -specific format, please perform the
following:

Once the key is unlocked, open Disk Utility from Applications/Utilities/Disk Utilities.

To format the Aegis Secure Key:

1. Select the Aegis Secure Key from the list of keys and volumes. Each key in
the list will display its capacity, manufacturer, and product name, such as 232.9
Apricorn Secure Key.

2. Click the Erase tab.

3. Enter a name for the key. The default name is Untitled. The key’s name will
eventually appear on the desktop.

4. Select a volume format to use. The Volume Format dropdown menu lists the
available key formats that the Mac supports. The recommended format type is
Mac OS Extended (Journaled.)

5. Click the Erase button. Disk Utility will unmount the volume from the desktop,
erase it, and then remount it on the desktop.
16 17
Diagnostic Mode Removable Media / Fixed Disk Toggling

The keypad has a manual diagnostic mode built-in to verify proper keypad Two devices in one: Windows, Mac, and Linux all deal with Mass Storage
function and troubleshooting key issues. This mode will not allow access to devices differently depending on whether they report themselves to the host
any data or admin function. It can only be used to identify the firmware level as Removable Media or as Fixed Disks. Some applications or embedded
and to test button recognition. systems may allow one type but not the other. Example: Windows 2 Go will
To enter the diagnostic function: work with devices that report as Fixed Disk but not as Removable Media.
Alternately, there are USB boot drive creators and Windows imaging tools
1. Press , then press LOCK + 1, release, then press and continue to hold that will only work with Removable Media and not with Fixed Disk. It’s not
the 0 button as the RED and BLUE LEDs blink alternately. Once all uncommon for older equipment with built-in USB ports (such as those found
three LEDs illuminate solidly, release the 0 button. in hospitals, manufacturing, and monitoring) to only look for Removable
2. The BLUE LED will blink a number of times to represent the number of both Media and ignore any Fixed Disk that is attached.
the major and minor revisions. The decimal point will be represented by a To accommodate all situations, Apricorn has developed a means to allow the
single RED LED blink. Upon completion, the BLUE LED will glow solidly. Secure Key 3NX to be configured as either Fixed Disk or Removable Media.
(Example: VERSION 4.1 would be indicated by four BLUE LED blinks, one By default, the drive is set as Removable Media but can be easily changed
RED LED blink, one BLUE LED blink, and one RED LED blink, then revert to Fixed Disk in the Admin mode and can be toggled between these modes
to the BLUE LED glowing solidly.) as needed. (The default boot record is set to MBR; If you need to set the
drive as Fixed Disk and use a GPT boot record, either reset the drive or use
3. To check the keypad’s button functionality, press each button and the
a tool like Diskpart to clean the drive to allow a new boot record and format
number of the button pressed will be expressed by the RED LED blinking.
to be applied.)
(Example: 1 Button= 1 blink, 2 Button = 2 blinks, 3 Button = 3 blinks...0
Button = 10 blinks, Button = 11 blinks, Button = 12 blinks.) To enter the diagnostic function:
4. To exit the Diagnostic Mode, wait for the 20 second timeout or hold the 1. Enter the Admin mode. (Press and hold + 0 for five seconds – while
Lock Button for ~7 seconds to return the key to its normal operation. the RED LED is blinking, enter the Admin PIN and press the button.)
The BLUE LED will glow solidly, then perform one of the following:
Self-Diagnostics:
2. FIXED DISK MODE: Press the 3 + 2 buttons together. The GREEN
During the initial power up, after the key has been plugged into a USB port,
LED will blink to indicate the command was accepted.
the key will perform self-diagnostics on the encryption algorithm and critical
hardware components. If the RED LED blinks at a rate of one blink per 3. REMOVABLE MEDIA MODE: Press the 7 + 3 buttons together. The
second for 15 seconds, returns to standby and will not unlock, unplug the GREEN LED will blink to indicate the command was accepted.
key from USB port and try again. If the RED LED continues to blink in the
4. Drive will return to the Admin Mode, indicated by a solid BLUE LED.
manner mentioned above and won’t unlock upon USB re-insertion, a critical
component has failed and the key can no longer function. 5. Press the LOCK button to return the device to standby mode.
If the key blinks a triple-RED LED pattern that is repeated every two
seconds when unlocked, a failure has occurred that will not immediately
stop the device from working nor affect the security of the device, but
should be considered as a warning that the device needs to be replaced in
the near future. Additionally, Admin features may be limited in this mode.
If either condition should appear, remove the key from the USB port and
allow the key to go to sleep, and try to unlock the key again. The event of
either diagnostic failure will be very rare, but if the key cannot recover, it
must be replaced.

18 19
Lock-Override Mode FAQs

Certain users may encounter a case where they need the key to remain This section contains troubleshooting information for the Aegis Secure Key. More can
unlocked during a reboot, passing the key through a virtual machine or other be found in the FAQs section on apricorn.com
similar situation which, under normal circumstances, would cause the key to
Q: What can I do if I forget the User PIN?
lock. To help facilitate this use case, “Lock-Override Mode” will allow the key
to remain unlocked through USB port re-enumeration and will not lock again A: Use the Admin PIN to enter the Admin Mode and create another User PIN or (if
until USB power is interrupted. programmed at configuration) utilize one of the data recovery PINs programmed
into the device to create a state of User forced enrollment. Once a new user PIN is
NOTE: When in this mode, the key is vulnerable to being moved from one created, the User will be able to regain access the device’s data.
computer and connected to another computer provided USB power is
uninterrupted. Due to this vulnerability, we strongly recommend this mode be Q: What can I do if I forget the Admin PIN?
used ONLY in circumstances where the key can be physically secured (as in
A: In the case of forgotten Admin and User PINs, if data recovery PINs were
a locked Server Room) or in a place where it can be visually monitored while programmed into the drive at the time of setup, then you can use one of them to
in this mode. Use of a powered hub or a Y-cable increases this security risk. create a state of User Forced Enrollment and generate a new User PIN to gain
Always return the key to the default Lock-Override Mode OFF when access to (and back up) the drive’s contents. Once complete, you must then perform
returning to normal service. a complete reset of the Aegis Secure Key where all PINs and data will be erased and
you will need to reconfigure / reformat the Aegis Secure Key, creating a new Admin
To set the “Lock-Override” to On: PIN which will allow you to reload the previously backed-up data onto the device.

1. Enter the Admin Mode (Press and hold + 0 for five seconds until the Q: How do I use the Aegis Secure Key without a PIN?
RED LED blinks, then enter the Admin code and press the button.) The
BLUE LED will glow solidly. A: As a full disk encryption product, the Aegis Secure Key can never be used without
a PIN.
2. Press the 7 + 1 together until the GREEN LED blinks three times,
Q: What encryption algorithm is used in this product?
followed by the BLUE LED glowing solidly.
A: The Aegis Secure Key uses AES 256-bit algorithm.
3. When the key is unlocked and attached to a USB port in “Lock-Override
Mode”, the BLUE LED will blink once every three seconds to alert you Q: The LED is blinking RED and I can’t enter a code. Why?
that the “Lock-Override” mode is active.
A: Somebody has tried to access the key and the code has been entered 10 times
Note: If “Unattended Auto-Lock” mode has been turned on, “Lock-Override” incorrectly (see the Brute Force section of this manual.)
will not override it; the key will lock itself upon reaching the selected amount
of inactivity. If you need the key to stay unlocked, Enter the Unattended Q: Why does the LED indicate an error when I try to change the PIN?
Auto-Lock Feature and set the lock timer to “0” (0 = OFF) See Page 10.
A: PIN requirements for this key must meet a minimum security level. There are
To turn Lock-Override Mode off and return to normal operation: several combinations that are not allowed, such as repeating numbers or sequential
numbers. The PIN must be a minimum of seven digits, and not longer than 16 digits.
4. Enter the Admin Mode.
Q: What are the ECCN and HST codes used for shipping this device outside
5. Press the 7 + 0 together until the GREEN LED blinks three times, of the United States?
followed by the BLUE LED glowing solidly.
A: ECCN: 5A992.c and HTS code 8473.50.3000
6. To verify, unlock the key in User mode and check that the BLUE LED is
no longer blinking.

20 21
Technical Support Quick Reference Guide for
Apricorn provides the following helpful resources for you: Programming Key Combinations
1. Apricorn’s Website (http://www.apricorn.com)
Standby Mode
This gives you the ability to check for up-to-date information
• 7+6 = Read-Only On
2. E-mail us at [email protected]
• 7+9 = Read-Only Off
3. Or call the Technical Support Department at 1-800-458-5448
• +1 then hold 0 = Diagnostic Mode
Apricorn’s Technical Support Specialists are available from
User Mode
8:00 a.m. to 5:00 p.m., Pacific Time, Monday through Friday
• + 1 = Enter User PIN (from forced enrollment state)

• + 3 = Set Self-Destruct PIN

Warranty and RMA information ADMIN Mode

• + 0 = Enter Admin Mode
Three Year Limited Warranty:
Apricorn offers a 3-year limited warranty on the Aegis Secure Key against defects in • + 1 = Create User PIN
materials and workmanship under normal use. The warranty period is effective from the
date of purchase either directly from Apricorn or an authorized reseller. • + 2 = not used

Disclaimer and terms of the warranties: • + 3 = Set Self Destruct PIN Admin or User setup
THE WARRANTY BECOMES EFFECTIVE ON THE DATE OF PURCHASE AND MUST BE VERIFIED
WITH YOUR SALES RECEIPT OR INVOICE DISPLAYING THE DATE OF PRODUCT PURCHASE. • + 4 = Set Minimum PIN length

APRICORN WILL, AT NO ADDITIONAL CHARGE, REPAIR OR REPLACE DEFECTIVE PARTS • + 5 = Set Brute Force Attempts
WITH NEW PARTS OR SERVICEABLE USED PARTS THAT ARE EQUIVALENT TO NEW IN
PERFORMANCE. ALL EXCHANGED PARTS AND PRODUCTS REPLACED UNDER THIS • + 6 = Auto Lock
WARRANTY WILL BECOME THE PROPERTY OF APRICORN.
• + 7 = Set Recovery PIN
THIS WARRANTY DOES NOT EXTEND TO ANY PRODUCT NOT PURCHASED DIRECTLY
FROM APRICORN OR AN AUTHORIZED RESELLER OR TO ANY PRODUCT THAT HAS BEEN • + 8 = 1X Use to Enter Recovery PIN
DAMAGED OR RENDERED DEFECTIVE: 1. AS A RESULT OF ACCIDENT, MISUSE, NEGLECT,
ABUSE OR FAILURE AND/OR INABILITY TO FOLLOW THE WRITTEN INSTRUCTIONS PROVIDED • + 9 = Enter / Change Admin PIN
IN THIS INSTRUCTION GUIDE: 2. BY THE USE OF PARTS NOT MANUFACTURED OR SOLD
BY APRICORN; 3. BY MODIFICATION OF THE PRODUCT; OR 4. AS A RESULT OF SERVICE, • 7+1 = Turn Lock Override On
ALTERNATION OR REPAIR BY ANYONE OTHER THAN APRICORN AND SHALL BE VOID. THIS
WARRANTY DOES NOT COVER NORMAL WEAR AND TEAR. • 7+0 = Turn Lock Override Off

NO OTHER WARRANTY, EITHER EXPRESS OR IMPLIED, INCLUDING ANY WARRANTY OR • 7+ 4 = Disable / Enable Self-Destruct PIN
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, HAS BEEN OR WILL BE
MADE BY OR ON BEHALF OF APRICORN OR BY OPERATION OF LAW WITH RESPECT TO THE • 7+6 = Read-Only On
PRODUCT OR ITS INSTALLATION, USE, OPERATION, REPLACEMENT OR REPAIR.
• 7+9 = Read-Only Off
APRICORN SHALL NOT BE LIABLE BY VIRTUE OF THIS WARRANTY, OR OTHERWISE, FOR
ANY INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGE INCLUDING ANY LOSS OF • 7+8 = Erase User and Self-Destruct PIN’s
DATA RESULTING FROM THE USE OR OPERATION OF THE PRODUCT, WHETHER OR NOT
APRICORN WAS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES. • 0+1 = Set Forced-Enrollment for User

• 0+3 = Turn On LED Flicker When Entering PIN from Standby

• 0+4 = Turn Off LED Flicker When Entering PIN from Standby

22 23
© Apricorn 2018. All rights reserved.
12191 Kirkham Road
Poway, CA, U.S.A. 92064
1-858-513-2000 www.apricorn.com 24