A data storage device (10, 100) adapted to carry out a method for securing data in a data storage device (10, 100) capable of being secured by a password, the data storage device (10, 100) being provided with a content protection key K, the data storage device comprising: means adapted to receive a public key B =bP generated from a private key b at a remote location, the private key b being stored at the remote location, and P being an elliptic curve point; means adapted to generate (235, 240) a private key d and a public key D from the private key d, such that D=dP; means adapted to generate a key encryption key L from the private key d and the public key B; means adapted to encrypt the content protection key K with the password to provide an encrypted content protection key, and store the encrypted content protection key in the data storage device; means adapted to encrypt the password with the key encryption key L to provide an encrypted password, and store the encrypted password in the data storage device; means adapted to destroy the private key d and the unencrypted content protection key K at the data storage device; means adapted to encrypt content stored in the data storage device using the content protection key K before encrypting the content protection key K and storing the encrypted content protection key at the data storage device; means adapted to recover the password from the encrypted password stored in the data storage device by: generating a random value r; computing a public key D' = rD; transmitting the public key D' to the remote location; receiving from the remote location a public key L' = bD'; computing a function r -1 L' to derive the key encryption key L wherein r -1 is an inverse value of r; means adapted to decrypt, using the key encryption key L thus derived, the password previously encrypted using the key encryption key L; means adapted to decrypt the encrypted content protection key K using the password thus recovered to obtain the content protection key K; and means adapted to use the content protection key K thus obtained to encrypt content for storage in the data storage device. means adapted to receive a public key B =bP generated from a private key b at a remote location, the private key b being stored at the remote location, and P being an elliptic curve point; means adapted to generate (235, 240) a private key d and a public key D from the private key d, such that D=dP; means adapted to generate a key encryption key L from the private key d and the public key B; means adapted to encrypt the content protection key K with the password to provide an encrypted content protection key, and store the encrypted content protection key in the data storage device; means adapted to encrypt the password with the key encryption key L to provide an encrypted password, and store the encrypted password in the data storage device; means adapted to destroy the private key d and the unencrypted content protection key K at the data storage device; means adapted to encrypt content stored in the data storage device using the content protection key K before encrypting the content protection key K and storing the encrypted content protection key at the data storage device; means adapted to recover the password from the encrypted password stored in the data storage device by: generating a random value r; computing a public key D' = rD; transmitting the public key D' to the remote location; receiving from the remote location a public key L' = bD'; computing a function r -1 L' to derive the key encryption key L wherein r -1 is an inverse value of r; generating a random value r; computing a public key D' = rD; transmitting the public key D' to the remote location; receiving from the remote location a public key L' = bD'; computing a function r -1 L' to derive the key encryption key L wherein r -1 is an inverse value of r; means adapted to decrypt, using the key encryption key L thus derived, the password previously encrypted using the key encryption key L; means adapted to decrypt the encrypted content protection key K using the password thus recovered to obtain the content protection key K; and means adapted to use the content protection key K thus obtained to encrypt content for storage in the data storage device.