What A BitLocker Encrypted Drive Looks Like On Another PC

It looks like this:

After refreshing the view it looks like this:

And, in Windows Explorer after clicking on the encrypted partition showing as G: with no file system indicator we get:

The above screenshots are from the Tecra S10’s 160GB spindle based hard disk that has since been replaced by an Intel X-25 M 160GB SSD.

The E: partition was the Active one that contained the BCD database and other files needed for the initial boot of the Windows 7 Enterprise.

The E: partition was actually a misguided attempt at setting up BitLocker with Windows 7 since the discovery that Windows 7 would create its own 100MB partition for the boot content was made after the fact.

This time around, we allowed Windows to install into the new SSD without touching any of the partitioning and we now have a BitLocker encrypted SSD in the Tecra S10 with nothing more than a small Active partition. The encryption process looks to be more CPU dependent that drive I/O dependent as the encryption time may have been reduced by 35%.

So, any guesses on whether the data in that encrypted partition is accessible? Perhaps by someone with a lot of horsepower like law enforcement or perhaps an organized crime syndicate of some sort . . . maybe.

For now, with BitLocker we have taken the best possible precautions at protecting the data on that drive and can be reasonably assured that the data will remain intact until we wipe the drive using a DoD 7 pass erase.

For that DoD 7 pass wipe we use a freeware product called Eraser. It is an excellent little utility that allows us to wipe as many drives as this particular system can handle (7+ drives).

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Windows Vista - Kingston DTSP Data Traveler Error: Requires Two Free Drive Letters

Having recently placed our first Windows Vista client into one of our accounting firm clients, we are discovering all sorts of interesting hiccups.

One hiccup is with the Kingston DataTraveler Secure - Privacy Edition. Every member of the firm is required to use this device when carrying around client data.

This keeps the client data protected by a strict password and hardware encryption.

On Windows XP Professional, the flash drive works really well. On Windows Vista however, the security software stalls.

Essentially there are two partitions on the flash drive: One that mimics a CDROM and spools up the software to access the second partition that is hardware encrypted.

Even if we allow the software on the "CD" partition to run when prompted by Windows Vista, it stalls.

It turns out that there is a Kingston support entry for this problem on Windows Vista: Issue: KTP-012210-3 After inserting the DTSP into a Windows Vista computer, I received an error stating, "DTSecure Privacy requires two free drive letters.".

To resolve the error, we need to update the firmware on the DataTreveler. We contacted Kingston's Technical Support and were directed to a password protected FTP site with the appropriate firmware update.

Note that the firmware update will format the encrypted partition, so make sure that no data resides on the DataTreveler before updating it.

Once the firmware was updated, we needed to run through the setup routine to set the access password and user information to the flash drive.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Windows Vista - BitLocker caveat - Or maybe not?

Looking forward to incorporating full encryption via the new Windows Vista BitLocker Drive Encryption? We are, and so are our clients who have a huge exposure with client data on all of their laptops.

EFS was not a foolproof option. BitLocker is.

However, a little beforehand research is in order.

One needs to have at least two (2) volumes created before installing Windows Vista.

At least that is how it reads until about the middle of the Help article where it states that if you only have one volume, you can use the BitLocker Drive Preparation Tool to "help get your system ready for BitLocker by creating the required second partition".

From the Windows Vista Help for BitLocker:

Set up your hard disk for BitLocker Drive Encryption

Before you can turn on BitLocker Drive Encryption you need to make sure that your computer's hard disk has the following:

At least two volumes. If you create a new volume after you have already installed Windows, you will have to reinstall Windows before turning on BitLocker [emphasis ours].

One volume is for the operating system drive (typically drive C) that BitLocker will encrypt, and one is for the active volume, which must remain unencrypted to start the computer. The size of the active volume must be at least 1.5 gigabytes (GB). Both partitions must be formatted with the NTFS file system.

Note

The terms partition and volume are often used interchangeably. On most computers, they are the same: one partition equals one volume. On larger computer systems, however, it is possible to have a single volume span several partitions. BitLocker installs on a simple volume, where one volume equals one partition.

If you do not already have two partitions, you can use the BitLocker Drive Preparation Tool to help get your system ready for BitLocker by creating the required second partition [emphasis ours].

If you are using Windows Vista Ultimate, you can download and install the BitLocker drive preparation tool from Ultimate Extras. Download and install the Ultimate extra called BitLocker and EFS enhancements. After you have installed this tool, type BitLocker into the Start menu search box, and then double-click BitLocker Drive Preparation Tool to run the tool. After the tool runs, you must restart your computer before turning on BitLocker.

If you are using Windows Vista Enterprise, you can get the BitLocker drive preparation tool through these standard support channels:

Microsoft Volume Licensing Services

Microsoft Services Premier Support

Additional information about the BitLocker drive preparation tool is available in Knowledge base article KB# 930063.

If your computer meets these requirements, you can turn on BitLocker.

To turn on BitLocker
Click to open BitLocker.‌ If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

Click Turn on BitLocker.

Follow the instructions in the BitLocker Setup wizard.

From the above mentioned Knowledge base article:

How to obtain the BitLocker Drive Preparation Tool

Windows Vista Ultimate

If you are using Windows Vista Ultimate, follow these steps to obtain the tool:

1. Click Start, type Windows Update in the Start Search box, and then press ENTER.
2. Click Check for updates.
3. Click View available Extras.
4. Click to select the BitLocker and EFS enhancements check box, and then click Install.

We don't have a free system with a TPM at the moment. So, we won't be able to run through the setup procedure to figure out just what is up.

To the Windows Vista team that wrote this particular Help item, please clarify whether we need to have two partitions/volumes before we install the OS or not. The above Help article certainly, at least in our opinion, doesn't make things clear.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.