In 2002, Microsoft Chief Software Architect Bill Gates issued a now famous e-mail entitled ‘Trustworthy Computing’ which was sent to every single Microsoft employee at the company. Within it, he expressed his desire to create a platform ‘that is as available, reliable and secure as electricity, water services and telephony.’ Come 2007 and Trustworthy Computing was only further emphasised by the inclusion and introduction of the TPM. A TPM (Trusted Platform Module) ensures that all data is encrypted securely and that the data has not been edited in any way during boot; this is used in conjunction with an encryption key which has to be made available to the system during boot to ensure data integrity. If anything untoward is detected, or the TPM suspects data integrity may have been comprimised, it blocks startup of your PC and prompts for a ‘Recovery Password’ which will be set during this guide.
The TPM was originally to be included on Motherboards as an installable module but has now been fully integrated into brands available today, but, unlike Microsoft may have you believe, you can use Windows BitLocker without installing a TPM Module. Follow the guide below to discover how you can enable and use enhanced EFS Encryption with a USB Flash Disk and a few hours of your time.
Please note: Only users of Vista Ultimate and Vista Enterprise can use Windows BitLocker. If you are using any other version of Windows Vista, you cannot use the following feature.
Requirements: The following requirements must be met to achieve this guide aim:
- Microsoft Windows Vista Ultimate or Enterprise editions.
- USB Flash Disk
- Microsoft Windows BitLocker Driver Preparation Tool (Available via Windows Ultimate Extras in Windows Update)
- A backup of your system and files
- At keast 1.5GB of free hard drive space (Please defragment your hard disk before beginning this guide)
- Windows BitLocker Encryption is only usable on a ‘Simple’ setup. You cannot use Windows Vista’s software RAID features with Windows BitLocker but you can use it with a hardware RAID as this is not viewable within the Operating System.
Step 1 - Beginning The Encryption ProcessTo begin the encryption process, navigate to ‘Control Panel - Security‘ within the Control Panel and select ‘Protect your computer by encrypting data on your disk.‘ This will require that you either select continue when prompted by UAC or enter your Administrator password if set.
You will recieve the following messages:
“The drive configuration is unsuitable for BitLocker Drive Encryption. To use BitLocker, please re-partition your hard drive according to the BitLocker requirements.”
“A TPM was not found. A TPM is required to turn on BitLocker. If your computer has a TPM, contact that computer manufacturer for BitLocker-compatible BIOS.”
As previously stated, you do not require a TPM to enable and use Windows BitLocker. The requirement is simply a setting within Windows’ Group Policy, which in turn is stored within the Windows Registry. To remove the TPM requirement, we require to edit a Group Policy setting; Step Two explains the process below.
Step 2 - Editing Window’s Group PolicyTo edit Window’s Group Policy settings, we require to load the MMC module. To do this, type ‘gpedit.msc‘ into Start Search. Click the relevant icon and wait for the Group Policy Editor to load. Now we will edit the Windows BitLocker Driver Encryption component of Group Policy to remove the ‘requirement’ of TPM. Navigate the following path within the Group Policy Editor: Local Computer Policy - Computer Configuration - Administrative Templates - Windows Components - BitLocker Drive Encryption.
Select the BitLocker Drive Encryption folder. The right-hand panel should display an entry entitled ‘Control Panel Setup: Enable Advanced Startup Options’. Double-click this entry and you will be presented with a dialogue box. Select the ‘Enabled‘ option from the triad of options at the top of the dialogue box and ensure that the option ‘Allow BitLocker without a compatible TPM.‘ is selected. Select ‘OK‘ and exit the Group Policy Editor.
Once again navigate to ‘Control Panel - Security’ and once again select ‘Protect your computer by encrypting data on your hard disk.’ The TPM warning will not be displayed as you have allowed the use of a non-TPM device to be used. In my guide, it is a USB Flash Disk.
Step 3 - Using The Windows BitLocker Drive Preparation ToolUsing Start Search once again, type ‘BitLocker‘ into the field and select the ‘BitLocker Drive Preparation Tool’ from the listed results. This will launch the Windows BitLocker Drive Encryption Wizard. The Wizard resizes your Operating System partition and prepares a new partition. Depending on the fragmentation status of your hard disk, this may be a long process.
Your PC will be restarted during this process and you can login as normal. Navigate one final time to ‘Control Panel - Security’ and select ‘Protect your computer by encrypting data on your hard disk.’ Select ‘Turn On BitLocker’. You will then be asked to save your Startup Key to a location; a USB Flash Disk. Insert and select the device. Click ‘Save’.
Next you will be prompted to save a ‘Recovery Password’. This is used to unblock your PC’s boot process if anything untoward is detected and the Operating System believes that data may have been edited maliciously. It is recommended that you save the password in at least one location and keep the password very safe. If you cannot locate the password when needed, you cannot recover it. You can save the Recovery Password on the USB Flash Disk also, alongside the Startup Key, but I recommend you also print a copy of the password for future reference if required.
Step 4 - Running Windows BitLocker System CheckOnce you have backed up your passwords to safe locations, click ‘Next’ and you will be presented with the final page of the process. Ensure that the ‘Run BitLocker System Check’ checkbox is selected, and if not, select it to ensure that the computer can retrieve and decryt your encryption key correctly. Once it has been verified that the data can be retrieved successfully, the encryption process will begin annd your PC will be restarted.
Please ensure that the USB Flash Disk remains inserted when your PC restarts so that it can be read to begin the encryption of your hard disk. Windows BitLocker Driver Encryption has been successfully enabled and configured and you can rest assured that your data will be better secured against theft.
Thanks to Windows Vista Magazine.