{"id":2545,"date":"2015-06-19T03:10:56","date_gmt":"2015-06-18T23:10:56","guid":{"rendered":"https:\/\/rakhesh.com\/?p=2545"},"modified":"2015-06-19T03:10:56","modified_gmt":"2015-06-18T23:10:56","slug":"fyi-self-encrypting-drives-must-be-uninitialized-for-bitlocker-hardware-encryption","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/windows\/fyi-self-encrypting-drives-must-be-uninitialized-for-bitlocker-hardware-encryption\/","title":{"rendered":"FYI: Self Encrypting Drives must be uninitialized for BitLocker Hardware encryption"},"content":{"rendered":"

Got myself a new 1TB Crucial MX200 SSD<\/a> today. This is a Self Encrypting Drive<\/a> like my other SSDs. When I tried enabling BitLocker on it as I usually do, I noticed that it was asking me about how to encrypt the drive and taking more time with the encryption than I have seen in the past with SED drives that support the TCG OPAL standard.\u00a0<\/p>\n

\"Not<\/a>
Not good if you get this screen!<\/figcaption><\/figure>\n

Something was not right. So I went back to Microsoft’s page<\/a> on BitLocker and SEDs and noticed that one of the requirements was that the drive must be uninitialized! Damn! In the past I usually enable encryption and then copy over data, but today I had copied the data first (thus initializing the drive and creating partitions) and then<\/em> I was trying toe enable encryption. Obliviously that was a no-go so I had to copy the data out of the drive, uninitialize it, and then turn on BitLocker encryption.\u00a0<\/p>\n

Uninitializing is easy via diskpart<\/code>:\u00a0<\/p>\n

DISKPART> list disk\r\n\r\n  Disk ###  Status         Size     Free     Dyn  Gpt\r\n  --------  -------------  -------  -------  ---  ---\r\n  Disk 0    Online          447 GB  1024 KB        *\r\n  Disk 1    Online          931 GB  1024 KB        * <--- this is my SED\r\n  Disk 2    Online          119 GB      0 B\r\n  Disk 3    Online          931 GB      0 B        *\r\n  Disk 4    Online          465 GB  1024 KB\r\n\r\nDISKPART> select disk 1\r\n\r\nDisk 1 is now the selected disk.\r\n\r\nDISKPART> list partition\r\n\r\n  Partition ###  Type              Size     Offset\r\n  -------------  ----------------  -------  -------\r\n  Partition 1    Reserved           128 MB    17 KB\r\n  Partition 2    Primary            400 GB   129 MB\r\n  Partition 3    Primary            531 GB   400 GB\r\n\r\nDISKPART> clean\r\n\r\nDiskPart succeeded in cleaning the disk.\r\n\r\nDISKPART> list partition\r\n\r\nThere are no partitions on this disk to show.\r\n\r\nDISKPART> exit\r\n\r\nLeaving DiskPart...<\/pre>\n
Now Disk Management will show the disk as uninitialized.\u00a0<\/p>\n
\"uninit\"<\/a><\/p>\n
Create partitions as usual but before writing any data<\/strong> to the disk turn on BitLocker encryption. This time it will be a one-second operation and you won’t get a prompt like above.\u00a0<\/p>\n
To confirm that the drive is hardware encrypted (in case you wonder whether BitLocker didn’t just zip through coz the drive had no data on it) use the manage-bde<\/code> command:<\/p>\n
C:\\>manage-bde -status\r\nBitLocker Drive Encryption: Configuration Tool version 6.3.9600\r\nCopyright (C) 2013 Microsoft Corporation. All rights reserved.\r\n\r\nDisk volumes that can be protected with\r\nBitLocker Drive Encryption:\r\n\r\nVolume D: [DATA]\r\n[Data Volume]\r\n\r\n    Size:                 450.00 GB\r\n    BitLocker Version:    2.0\r\n    Conversion Status:    Fully Encrypted\r\n    Percentage Encrypted: 100.0%\r\n    Encryption Method:    Hardware Encryption - 2.16.840.1.101.3.4.1.42\r\n    Protection Status:    Protection On\r\n    Lock Status:          Unlocked\r\n    Identification Field: Unknown\r\n    Automatic Unlock:     Enabled\r\n    Key Protectors:\r\n        Password\r\n        Numerical Password\r\n        External Key (Required for automatic unlock)<\/pre>\n
As you can see the drive is hardware encrypted.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
Got myself a new 1TB Crucial MX200 SSD today. This is a Self Encrypting Drive like my other SSDs. When I tried enabling BitLocker on it as I usually do, I noticed that it was asking me about how to encrypt the drive and taking more time with the encryption than I have seen in … Continue reading FYI: Self Encrypting Drives must be uninitialized for BitLocker Hardware encryption<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[85],"tags":[60,138,139,137],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/2545"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=2545"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/2545\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=2545"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=2545"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=2545"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}