Els's blog

Monday, November 27, 2006

Bitlocker Drive Encryption (without TPM)

Most of you have probably already heard about Bitlocker. But for those of you who don't know it, here's a short overview.

Bitlocker is a data protection feature available in Windows Vista and Longhorn Server. It is implemented to address the threats of data theft or exposure from lost or stolen PCs.

Bitlocker prevents a thief who boots another operating system or runs a software hacking tool from breaking Windows Vista file and system protections or performing offline viewing of the files stored on the protected drive.

Bitlocker enhances data protection by bringing together two major sub-functions: full drive encryption and the integrity checking of early boot components:

  • Drive encryption protects data by preventing unauthorized users from breaking Windows file and system protection on lost or stolen computers. This protection is achieved by encrypting the entire Windows volume. With Bitlocker all user and system files are encrypted including the swap and hibernation files.
  • Integrity checking the early boot components helps to ensure that data decryption is performed only if those components appear unmolested and that the encrypted drive is located in the original computer.

The feature ideally uses a Trusted Platform Module (TPM 1.2) to protect user data and to ensure that the PC has not been tampered with while the system was offline.
A TPM is a microchip designed to provide basic security-related functions, primarily involving encryption keys.

Now what if you do not have a TPM, but you would like to use Bitlocker Drive Encryption?
No problem, BDE is supported on machines without TPM. The only tricky part is that you cannot enable it using the GUI. In Control Panel (where you would normally enable Bitlocker), you'll see the following:

bitlocker01

So, how do you enable bitlocker then?
You will have to use manage-bde, a cscript tool that works with Bitlocker through the WMI interface.

This is what you do:

  • Open a Command Prompt as administrator! (Rightclick the cmd shortcut in the Start menu and choose "Run as administrator".)
  • cscript manage-bde.wsf -on C: -sk h: -rp -rk f:

 Command  Explanation 
 -on C:  Enable BDE on drive C:
 -sk h:  Create a startup key and save it on drive h:
 Drive h: will normally be a USB key 
 -rp  Create a recovery password 
 -rk f:  Create a recovery key and save it on drive f:
 Drive f: can be a USB key, hard drive, network drive

  • Save the numerical recovery password in a save place!
  • Insert your USB drive.
  • Restart your computer for a hardware test.
  • Use manage-bde -status to check whether the test was successful. If it was, encryption will begin. You can use the same command to keep track of the encryption progress.

bitlocker05

9 Comments:

  • great posts on bitlocker!

    wanted to let you know that there's also a way to do this through UI. first, you'll need to configure a Group Policy setting.

    more info here:
    http://technet2.microsoft.com/WindowsVista/en/library/c61f2a12-8ae6-4957-b031-97b4d762cf311033.mspx?mfr=true

    By Anonymous Anonymous, at 1:37 AM  

  • Is the system still tamper proof with the usb key? I assume the startup key from the flash drive can't be used to decrypt the primary volume in another computer were both to be removed?

    By Blogger Reformed Clicker, at 9:22 PM  

  • good afternoon fellas. I'm actually into shoes and I had been searching for that exact brand. The prices as regards the sneakers were all over 320 pounds on every page. But completely I found this area selling them for half price. I really like those [url=http://www.shoesempire.com]prada sneakers[/url]. I will absolutely buy these. what do you think?

    By Anonymous Anonymous, at 8:51 PM  

  • Hello. And Bye.

    By Anonymous Anonymous, at 9:08 AM  

  • good afternoon people. I'm actually into shoes and I had been looking for the sake of that particular model. The prices for the shoes were all over 190 pounds on every site. But for all I bring about this location selling them someone is concerned half price. I exceptionally like those [url=http://www.shoesempire.com]gucci sneakers[/url]. I will probably purchase them. what is your opinion?

    By Anonymous Anonymous, at 10:13 PM  

  • hi there fellas. I'm actually into shoes and I was searching allowing for regarding that meticulous model. The prices seeking the sneakers are all over 180 dollars on every site. But completely I set this site selling them for the benefit of half price. I really love those [url=http://www.shoesempire.com]gucci sneakers[/url]. I will definetly buy those. what is your opinion?

    By Anonymous Anonymous, at 11:05 PM  

  • good morning dudes. I'm actually into shoes and I had been looking allowing for regarding that particular make. The prices for the velcros were around 180 dollars on every site. But finally I found this location selling them for half price. I really love these [url=http://www.shoesempire.com]gucci sneakers[/url]. I will absolutely order them. what can you say about it?

    By Anonymous Anonymous, at 3:18 AM  

  • It could offer you with ray ban wayfarer 2113 Outlet superior eyesight safety towards sunshine and ultraviolet radiation.Yahoo or yahoo and kfjgcxy0fsd google are the most ray ban wayfarer 2151 effective spot to come across ray ban Sunglass Outlet as this opens want you ray ban 3016 to assortment wholesalers providing very best sunglasses with good quality service. ray ban Radar Path Sunglasses There is absolutely nothing just like a real ray ban 3029 smile that very best complements ray ban Gascan S Sunglasses the elegance of your ray ban ray ban 3132 . enable me response the later on issue first. you perhaps can acquire these ray ban Jawbone Replacement Lenses from tens of tons of suppliers each on-line and offline. ray ban 3186 But just before buying, confirm whether or not its real ray ban M Frame Sunglasses good quality or not, mainly because the marketplace is ray ban 3212 flooded with imitations.ray ban sunglasses also can come in aviator style. ray ban 3269 This model is within in between the rimless and oversized options. Discount ray ban 3322 Thus, in scenario you would like to jazz up your boring and mundane lifestyle then just acquire ray ban Dispatch and obtain the rocking new look.Their contacts are produced of particular materials which makes certain total
    ray ban 3359 basic safety and looks.

    By Blogger 2011bagnews, at 9:54 AM  

  • But I may be one who does not careEver to have tree bloom or bear.
    Leaves and bark may be tree enough.Some giant trees hidh81ke have bloom so small.
    Wholesale New Era Hats
    Cheap 59fifty Hats
    Cheap New Era Hats
    New Era Snapback Hats
    New Era Fitted Hats

    By Blogger Unknown, at 3:18 AM  

Post a Comment

<< Home