In the past, it was a logical control on the physical drive. Even swapping out the drive electronics couldn't circumvent the password, so it took advanced tools, or hacked hardware to bypass the password.
Some 5 years ago or so, they began to do AES encryption on the disk itself, shipping the disk encrypted and encrypting the key with your password when you set it using the ATA Security Extensions.
Hitachi has a good FAQ about this:
Other manufacturers also provide similar features, on HDDs and SSDs
That said, a couple things to be aware of:
- Not all disks do this.
- This is black-box encryption
It's black-box because although they claim to use AES128, there's no reasonable way to verify it. And although they claim to do it properly, there's no way to inspect their implementation.
A few years ago I sent them a simple question... if all the drives ship from the factory with encryption turned on, then how do they seed their random key?
I never got an answer and I never heard anyone provide a reasonable explanation. For all we know, all the keys on all the drives are identical. Unless you have a method to bypass the drive electronics to read the raw, encrypted platters, you will never know. Even if you execute a ATA SE "secure erase" function to delete the key, you don't know how the new key is being generated.
Because of this, I don't rely on this technology to secure systems.