A data storage apparatus comprising a storage medium having a plurality of physical memory locations referenced through logical block addresses, and a secure partition having a table including at least one range of logical block addresses and identifying one or more functions that can be applied to the logical block addresses by an authorized entity. A method of access control performed by the apparatus is also included.