Windows Vista Tips

Windows Vista Tips > Newsgroups > Windows 64 Bit > UEFI and full-disk-encryption

Reply
Thread Tools Display Modes

UEFI and full-disk-encryption

 
 
feenberg
Guest
Posts: n/a

 
      01-07-2012
I have tried many full-disk-encryption programs with a new EFI based
motherboard, but none work correctly on the boot drive. The programs
were from Compusec, Winmagic, Truecrypt and Symantec. They seem to
work fine with our older BIOS based motherboards. I thought of using
Bitlocker, and even bought Windows Ultimate, but the motherboard does
not have a TPM chip, which seems to exclude encrypting the OS drive. I
posted more at

http://www.nber.org/sys-admin/uefi-e...ncryption.html

There is a hint on the link to technet that Bitlocker can encrypt the
OS partition, if it is separate from the boot partition. Can anyone
suggest where I can find instructions to do that with the retail
Windows package? My guess is that maybe all the packages would work if
I could do that.

Daniel Feenberg
 
Reply With Quote
 
 
 
 
Steve Foster
Guest
Posts: n/a

 
      01-07-2012
feenberg wrote:

> I have tried many full-disk-encryption programs with a new EFI based
> motherboard, but none work correctly on the boot drive. The programs
> were from Compusec, Winmagic, Truecrypt and Symantec. They seem to
> work fine with our older BIOS based motherboards. I thought of using
> Bitlocker, and even bought Windows Ultimate, but the motherboard does
> not have a TPM chip, which seems to exclude encrypting the OS drive. I
> posted more at
>
>
>

http://www.nber.org/sys-admin/uefi-e...ncryption.html
>
> There is a hint on the link to technet that Bitlocker can encrypt the
> OS partition, if it is separate from the boot partition. Can anyone
> suggest where I can find instructions to do that with the retail
> Windows package? My guess is that maybe all the packages would work if
> I could do that.


A default installation of Windows 7 on a fresh hard drive will always
have a separate boot and OS partition.

It's only if you override its creation of a 100MB boot partition that
you wouldn't.

--
Steve Foster
For SSL Certificates, Domains, etc, visit.:
https://netshop.virtual-isp.net
 
Reply With Quote
 
Dominic Payer
Guest
Posts: n/a

 
      01-07-2012
If you install Windows 7 on empty space, letting the installer partition
and format the disk, it will create a 100MB boot partition and then
install Windows 7 on a partition created in the remainder of the space.

If you partition the disk and specify an installation partition this
configuration is not created.


On 07/01/2012 01:30, feenberg wrote:
>
> There is a hint on the link to technet that Bitlocker can encrypt the
> OS partition, if it is separate from the boot partition. Can anyone
> suggest where I can find instructions to do that with the retail
> Windows package? My guess is that maybe all the packages would work if
> I could do that.
>
> Daniel Feenberg

 
Reply With Quote
 
Robert Carnegie
Guest
Posts: n/a

 
      01-07-2012
On Jan 7, 11:04*am, "Steve Foster" <stevefos...@invalid.invalid>
wrote:
> feenberg wrote:
> > I have tried many full-disk-encryption programs with a new EFI based
> > motherboard, but none work correctly on the boot drive. The programs
> > were from Compusec, Winmagic, Truecrypt and Symantec. They seem to
> > work fine with our older BIOS based motherboards. I thought of using
> > Bitlocker, and even bought Windows Ultimate, but the motherboard does
> > not have a TPM chip, which seems to exclude encrypting the OS drive. I
> > posted more at

>
> http://www.nber.org/sys-admin/uefi-e...isk-encryption....
>
>
>
> > There is a hint on the link to technet that Bitlocker can encrypt the
> > OS partition, if it is separate from the boot partition. Can anyone
> > suggest where I can find instructions to do that with the retail
> > Windows package? My guess is that maybe all the packages would work if
> > I could do that.

>
> A default installation of Windows 7 on a fresh hard drive will always
> have a separate boot and OS partition.
>
> It's only if you override its creation of a 100MB boot partition that
> you wouldn't.


When I read up on this, I think Microsoft documentation seemed to be
referring to the smaller partition that boots the PC as "system
partition" and to the partition containing most of the operating
system files as "boot partition", but I may have just confused myself.

If you can use "GUID partition table" or an extended partition, then
many separate partitions can be created easily and, as far as I could
see /without/ trying encryption, straightforwardly mounted under
folders on the Windows volume, replacing them. Would that work for
you? Either one per user, or one for all, but with users only having
access to go into their own folders.

I think I read a preview white paper about GPT on Windows that was
also pretty confusing - for each useable partition, Windows wanted to
have one or more placeholder partitions, or something.

I deleted my EFI software from hard disk and put an update downloaded
copy on an SD card instead, which worked until I misplaced the SD
card!
 
Reply With Quote
 
R. C. White
Guest
Posts: n/a

 
      01-07-2012
Hi, Robert.

> When I read up on this, I think Microsoft documentation seemed to be
> referring to the smaller partition that boots the PC as "system partition"
> and to the partition containing most of the operating system files as
> "boot partition", but I may have just confused myself.


Yes, this is one of the most-often-confused terminology issues, because it
is so counter-intuitive. But it is ingrained in computer literature. I
believe it pre-dates Windows or even MSDOS, before hard disk drives were a
part of everyday life, so it will be near-impossible to change it at this
stage. I just remember what Ed Bott (and others) said: "We BOOT from the
SYSTEM partition and keep the operating SYSTEM files in the BOOT volume."

That was always true, even when the ONLY partition on the ONLY disk was
always Drive C: and always functioned as both System and Boot partitions.
With multiple partitions and multiple drives, the functions were often
separated into different partitions - but not always. Even today, I suspect
that on the typical computer, good ol' Drive C: is both the System and Boot
partition - and few users know (or care) about this. ;^}

But the more-sophisticated user needs to study Disk Management (especially
its Help file) and KB314470 (for WinXP and prior, but still informative for
Vista/Win7 users) to understand the meanings of the terms.

RC
--
R. C. White, CPA
San Marcos, TX

Microsoft Windows MVP (2002-2010)
Windows Live Mail 2011 (Build 15.4.3538.0513) in Win7 Ultimate x64 SP1


"Robert Carnegie" wrote in message
news:1d68fadd-1b06-44fb-84f6-...

On Jan 7, 11:04 am, "Steve Foster" <stevefos...@invalid.invalid>
wrote:
> feenberg wrote:
> > I have tried many full-disk-encryption programs with a new EFI based
> > motherboard, but none work correctly on the boot drive. The programs
> > were from Compusec, Winmagic, Truecrypt and Symantec. They seem to
> > work fine with our older BIOS based motherboards. I thought of using
> > Bitlocker, and even bought Windows Ultimate, but the motherboard does
> > not have a TPM chip, which seems to exclude encrypting the OS drive. I
> > posted more at

>
> http://www.nber.org/sys-admin/uefi-e...isk-encryption....
>
> > There is a hint on the link to technet that Bitlocker can encrypt the
> > OS partition, if it is separate from the boot partition. Can anyone
> > suggest where I can find instructions to do that with the retail
> > Windows package? My guess is that maybe all the packages would work if
> > I could do that.

>
> A default installation of Windows 7 on a fresh hard drive will always
> have a separate boot and OS partition.
>
> It's only if you override its creation of a 100MB boot partition that
> you wouldn't.


When I read up on this, I think Microsoft documentation seemed to be
referring to the smaller partition that boots the PC as "system
partition" and to the partition containing most of the operating
system files as "boot partition", but I may have just confused myself.

If you can use "GUID partition table" or an extended partition, then
many separate partitions can be created easily and, as far as I could
see /without/ trying encryption, straightforwardly mounted under
folders on the Windows volume, replacing them. Would that work for
you? Either one per user, or one for all, but with users only having
access to go into their own folders.

I think I read a preview white paper about GPT on Windows that was
also pretty confusing - for each useable partition, Windows wanted to
have one or more placeholder partitions, or something.

I deleted my EFI software from hard disk and put an update downloaded
copy on an SD card instead, which worked until I misplaced the SD
card!

 
Reply With Quote
 
feenberg
Guest
Posts: n/a

 
      01-08-2012
On Jan 7, 6:04*am, "Steve Foster" <stevefos...@invalid.invalid> wrote:
> feenberg wrote:


>
> http://www.nber.org/sys-admin/uefi-e...isk-encryption....
>
>
>
> > There is a hint on the link to technet that Bitlocker can encrypt the
> > OS partition, if it is separate from the boot partition. Can anyone
> > suggest where I can find instructions to do that with the retail
> > Windows package? My guess is that maybe all the packages would work if
> > I could do that.

>
> A default installation of Windows 7 on a fresh hard drive will always
> have a separate boot and OS partition.
>
> It's only if you override its creation of a 100MB boot partition that
> you wouldn't.
>

I have 2 drives - the 100MB boot partition was on the other drive
and I didn't notice it yesterday. I found some instructions for
turning on bitlocker without TPM at

http://technet.microsoft.com/en-us/l.../cc732774.aspx

and did what it said. Then I went to right clicked on the c:\
icon and selected bitlocker, continuing through the menus to
encrypt the drive

The 500 GB drive, which contains only the OS default install
now claims only 6 GB free. The filling up of >450GB of space
happened instantaneously but is certainly a problem for me.
Is this an artifact of bitlocker? Did something go wrong?

Daniel Feenberg
 
Reply With Quote
 
 
 
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off




1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59