Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Solution for enabling BitLocker with Lion

I ran into trouble enabling BitLocker encryption after installing Lion and I finally found the solution, so I would like to post it here for others to read. After installing Lion, I decided to enable BitLocker encryption on my MacBook Air. I was faced with the following error:


Bitlocker setup could not find a target system drive. You may need to manually prepare your drive for Bitlocker.

After following many suggestions online, such as disabling paging and defragmenting, nothing worked. It turns out that with the new Recovery HD feature in Lion, you run into the issue that there are the maximum number of primary partitions on the drive and BitLocker Setup cannot create another one for its boot partition. You must manually remove the Recovery HD partition and recreate the Bootcamp partition. NOTE: You will lose the Recovery Partition and therefore must use a CD if you need to boot into the recovery from now on, like Snow Leopard and before was.


Here are the steps:

  1. Backup your Windows 7 to an external drive using Windows Easy Transfer.
  2. Use Boot Camp Assistant to restore your hard drive and remove the Bootcamp partition.
  3. Since the Recovery HD partition is a hidden partition, you cannot use Disk Utility to remove the partition.
  4. Open Terminal and run the following commands to delete the Recovery HD partition and manually create the Bootcamp partition:
    1. Type diskutil list to list the partitions on the drive.
    2. Find the Recovery HD partition listed. It will be of TYPE Apple_Boot and aptly named Recovery Partition. On my Mac it was listed as disk0s3.
    3. Type diskutil eraseVolume HFS+ Blank /dev/disk0s3. Be sure to replace disk0s3 with whatever you found as your Recovery HD partition's identifier.
    4. Type diskutil list and find your main Macintosh HD partition identifier. It is of TYPE Apple_HFS and likely named "Macintosh HD." Mine was disk0s2.
    5. Type diskutil mergePartitions HFS+ "Macintosh HD" disk0s2 disk0s3 . Be sure to replace disk02s with your Mac's main partition identifier, and disk0s3 with your (now erased) Recovery HD partition identifier.
    6. Now you have removed the Recovery HD partition and extended the main Mac partition.
    7. Next, we must manually create the Bootcamp partition. Determine how much to shrink the main Mac partition by taking its total size and subtracting how much you want for Bootcamp. For example, my Mac main partition was 120GB and I wanted Bootcamp to have 30GB, so I will resize to 90GB.
    8. Type diskutil resizeVolume disk0s2 90G. Be sure to replace disk0s2 with your Mac's main partition identifier.
  5. Now you have manually resized the partition and are left with empty space at the end of the drive. Close Terminal. You can now open Disk Utility. Select your main drive in the list at the left and go to the Partition tab. Click the "+" below the layout and create a new FAT partition labeled BOOTCAMP.
  6. Save the layout.
  7. Put your Windows DVD in your drive and reboot.
  8. Make sure you hold OPTION to select the Windows DVD to run. Install Windows, return your files and settings by using the Windows Easy Transfer file you saved earlier.
  9. BitLocker should now be able to encrypt your drive. If you get a TPM error, you must enable BitLocker to run without a TPM chip by using Group Policy Editor (google is your friend).

MacBookPro4,1, Mac OS X (10.6.2), Hardware Overview: Model Name: MacBook Pro Model Identifier

Posted on Jul 27, 2011 1:56 AM

Reply
13 replies

Jul 27, 2011 8:43 AM in response to power78

Thank you so much. This almost cost me my entire weekend to figure out. One more question:


does this disable full disk encryption for FileVault 2?


This would be a hugh deal breaker for purchasing Lion in combination with Windows 7. I do hope sometime there will be an opensource encryption software (like dm-crypt, truecrypt or diskcryptor) which will be ported to Mac OS X and allow FDE (TrueCrypt doesnt not provide yet).


Link to how to disable TPM:


http://nogitech.wordpress.com/2009/07/09/enable-bitlocker-without-tpm-chip-in-wi ndows-7/

Jul 27, 2011 9:10 AM in response to la_tristesse

Seems like the Recovery HD is vital for FileVault 2. Also see this:


http://arstechnica.com/apple/reviews/2011/07/mac-os-x-10-7.ars/13


Here's what happened after I deleted the "Recovery HD" and tried to manually convert the system partition (Macintosh_HD) to an encrypted volume. Mac OS X just recreated a "Apple_Boot" Volume.


https://gist.github.com/1109679


So the last possibility to get BitLocker and FileVault 2 to coexist would be to delete the GUID-Partition, since there is only a limit of 4 primary partitions on a hybrid mbr setup. Also see this for further information: http://www.rodsbooks.com/gdisk/hybrid.html I will look into that and reply again.

Jul 27, 2011 1:38 PM in response to la_tristesse

It's impossible to use BitLocker and FileVault 2 sidebyside on a single hdd. FileVault also needs a guid partition table and since mbr has a limit of 4 primary partitions there is no way to get this running.

$ diskutil cs convert /dev/disk0s3

Error converting disk to CoreStorage: A GUID Partition Table (GPT) partitioning


1. EFI Partion (GPT / For File Vault 2)

2. Mac OS X Lion Partition

3. Recovery Partition (Apple Boot / For File Vault 2)

4. Windows 7 NTFS Partition

5. System Drive Partition (NTFS / For BitLocker)


So this a dead end. I'm really disappointed about this development. If Apple would update their EFI Firmware to a more recent version there woundt even be the need for this awkward "hybrid mbr" solution and everything could run on GPT. I guess I would've to buy me a brand new macbook air to get EFI 2.0 (http://support.apple.com/kb/HT1237) or install a second hdd via optibay. What a bummer!

Aug 15, 2011 9:32 AM in response to power78

This has been anoying me for 3 weeks!


Today I have proved a work around solution using TrueCrypt and a USB key to boot windows:


1.) Lion installed and filevault 2 enabled.

2.) Windows 7 installed using bootcamp.

3.) TrueCrypt installed (official version).

4.) I built a hacked version of TrueCrypt that allows the system disk to be encrypted without installing the TC bootloader (this is the usual blocking issue).

5.) Run hacked TrueCrypt and run through the system disk encryption process, Including creation of a rescue USB disk as described in http://stdout-dev-null.blogspot.com/2010/02/truecrypt-rescue-disk-on-usb.html, NOTE: change the menu.lst references to hd1 to hd2.

6.) When rebooting into Windows 7 boot via the USB rescue disk.


If anyone wants the hacked TrueCrypt binary let me know, I will try and ask the TC guys to make this a general option.

Solution for enabling BitLocker with Lion

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.