Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

User profile for user: soletan
soletan Author
User level: Level 1
4 points

Using USB for Bitlocker in a Bootcamp install of Windows 7 x64 Ultimate on early-2011 Macbook Pro

First of all some details on my current setup:


Macbook Pro 15" (early 2011) with a i7 QM processor and 8 GB RAM, Superdrive and HD installed

Mac OS X 10.7.3

Windows 7 x64 Ultimate in a Bootcamp setup

Existing partitions on HD are EFI, MacOS X, Bitlocker Startup, Windows


I removed "Recovery HD" after creating DVD image contained in latest Lion installer from AppStore.


What I got so far:

It took some time to find a way for Windows getting a second partition to be used for Bitlocker startup files. Using existing partition layout I replaced previously existing "Recovery HD" partition for Bitlocker partition in Windows (after taking dd-based image of Recovery HD).


Recently I tried to enable Bitlocker and continued to fail on Bitlocker System Check claiming to have no access on USB while booting. And that's my issue ...


I read about using Windows' diskpart to have a GPT partitioned USB stick containing single NTFS partition. I tried to achieve the same with disk management in Mac OS X though it was creating a hybrid MBR/GPT setup that wasn't recognized by Windows at all. Then I tried partitioning in Mac OS X to have GPT partitioning, used Clonezilla Live CD's gdisk to apply hybrid setup another time. I even tried to do the whole partitioning in Linux using gdisk, but Windows still didn't recognize the formatted partition on USB stick then. So, the only way found is using diskpart in Windows to get a GPT-based USB-stick with a single NTFS partition.


I put my startup key there (attributed as hidden, system file) and tried to restart several times. On every boot Windows is prompting for inserting valid startup key as it wasn't found. The partition is encrypted already and entering the printed 48 digits recovery key gets me in every time.


If I keep the stick inserted the boot is noticeably delayed, but it's instantly continuing as soon as I unplug the stick. So there is something processing the stick ... I tried different sticks, but hope it's not related to using one special stick since they are used to support similar (equivalent) interfaces, aren't they?


Don't tell me about using TrueCrypt or similar as I prefer to use existing software instead of adding 3rd-party software doing things the same way. And for True Crypt USB must be readable at boot as well. And previous trials with different approaches rendered all failing at some point of setup. Finally, I don't want to reinstall existing Windows as it keeps me from working even more.


Found some post regarding trouble with Lion installations (e.g. I can't use rEFIt ... it simply didn't show up and this seems to be related to using Lion), found the KB article of Apple on preparing USB external storage for use at boot, but all troubleshooting hints didn't help.


What the heck is wrong with this setup?


EDIT: There is no problem to have Bootcamp starting previous Recovery HD partition now Bitlocker startup partition instead of originally prepared Bootcamp partition, which is encrypted now. This is in contradiction to other posts here. I'm sure Apple support isn't best choice to ask for support as this problem is MS specific and thus Apple won't care that much ...

MacBook Pro (15-inch Early 2011), Mac OS X (10.7.3), Superdrive, HD

Posted on Mar 3, 2012 5:04 AM

Reply
13 replies
User profile for user: soletan
soletan Author
User level: Level 1
4 points

Mar 3, 2012 6:11 AM in response to Shootist007

Well, this ain't helping in any way, is it?


As stated I'm running Windows as main system, but "main" isn't "only". Thus, dropping the mac won't solve "all" my problems.


Do you always need to know the full story, where I'm from, what I'm doing, what the heck of reason are there to buy a mac and not a PC?


So, please stop those (senseless, infantile) propositions to simply drop the mac ... there is no need to respond if you can't tell something useful ...

Reply
User profile for user: The hatter
The hatter
User level: Level 9
60,980 points

Mar 3, 2012 6:55 AM in response to soletan

I don't think I have seen a happy Bitlocker thread, though maybe someone solved their issues and didn't come back to close out the thread. Those tneded to be using Entterprise but that is probably minor.


most 'hits' look like dead-end rabbit hole rather than answers.... but:

http://www.bing.com/search?q=bitlocker+macbook+pro



Just noticed in the release notes that Carbon Copy Cloner will clone the Lion Recovery volume if needed.


Windows support, and more motherboards supporting UEFI should make it easier?


Along with EFI, which there is/was one for each HFS volume, there is of course the main GPT (which has the MBR protective layer and which Apple probably makes active but is there for XP and older/foreign OS to prevent them from over-writing a disk drive.


I use GPT even for data drives in Windows rather than MBR.


Windows tends to not have the necesary fan control from the sensors which to me is a real issue that has not been addressed. But the popularity and price of the MacBook line and of the Air in particular has meant a lot of people using them for linux only and Windows.

Reply
User profile for user: soletan
soletan Author
User level: Level 1
4 points

Mar 3, 2012 7:40 AM in response to The hatter

Well, I've seen lots of those threads as well and most failed to manage cooperation of Bitlocker and FileVault, have trouble to get a second partition for windows to use with bitlocker or truecrypt etc. But these issues don't apply to me anymore.


Next there are threads instructing how to get a USB stick to work with Bitlocker claiming to have GPT instead of MBR so EFI is gaining any access on them. Those cases seem to work with MacBooks running with Windows, only, thus passing the issues mentioned in paragraph before as well.


And there is my confusion originating from: I can remember some sites claiming to have trouble with EFI on a Mac using Lion, but all those sites are older than Lion's final release date. So I don't know if there is a similar issue today or if I'm actually missing some option ... rEFIt isn't working with Lion according to the refit site itself. Some sites claim EFI is behaving differently on whether there is a super drive or not as Lion isn't supporting USB booting as long as booting from DVD/CD is available ... what's true about those facts? Is my problem related to having a super drive? Are things getting better as soon as I'm replacing my superdrive by a second internal drive? Is it that strange or some sort of plausible behaviour?



According to GPT, Windows 7 is obviously failing to properly detect hybrid MBR/GPT setups on USB sticks while that's what MacOS' disk manager is doing on having GPT-based single partition stick with exFat format. Instead of using the second hybridized partition it's accessing the protected part, only. If I'm converting a disk to GPT in windows everything works fine, but then without hybridized MBR ...


Regarding the fans I'm with you ... as soon as processor load is exceeding 5% the fans get quite noisy ...

Reply
User profile for user: captaincrash7
captaincrash7
User level: Level 1
0 points

Mar 21, 2012 11:44 AM in response to soletan

I think the issue is that a number of MB Pros (mine for example; Mid 2010 17") present all of their USB ports via a built in hub, and the Bitlocker bootloader simply can't find the flash drive as it doesn't have a hub device driver.


You can see whether your model has an internal hub in device manager by selecting View, Devices by Connection and then drilling down to ACPI x65-based PC, PCI Bus, Intel (some series) USB Enhanced Host Controller. I bet if your device is attached directly to the USB Root Hub you are good to go. My model however has a Generic USB Hub underneath both of the USB Root Hubs presented by the host controller.


I'm going to take a look at the bootloader and see if anything can be done, but I'm not hopeful!

Reply
User profile for user: Csound1
Csound1
User level: Level 9
59,973 points

Mar 21, 2012 3:29 PM in response to soletan

The only way I have ever managed to use BitLocker on a Mac was to repartition the drive to 1 and then do a native install of Windows, this I do on MBA's for some clients who prefer to look cool but actually want Windows. It works extremely well but no Mac operating system onboard (you can still boot Lion from an external if you need to). Same goes for Truecrypt (which I actually prefer to BitLocker), but that's another thing.

Reply
User profile for user: soletan
soletan Author
User level: Level 1
4 points

Mar 21, 2012 3:48 PM in response to captaincrash7

@captaincrash7: Thanks for the reply. It's somewhat obvious to be driver related ... though EFI seems to gain access on properly formatted USB sticks and USB mass storage drivers and USB chipset drivers aren't that different anymore ...


However, according to some posts on the net it had been possible before:


http://social.technet.microsoft.com/Forums/en/w7itprohardware/thread/047b6288-a1 d0-4549-bd1a-af4d5b93b672

http://blogs.technet.com/b/askcore/archive/2011/06/10/bitlocker-on-mac-book-runn ing-windows-7-enterprise-edition.aspx


Both posts may be considered showcases for a running setup. Other posts suspect different EFIs for different configurations of same MBP models differing in SuperDrive equipped on delivery or not.


Additionally, I'm curious about refit failing to properly work on my MBP. According to the refit website this obviously isn't hardware related but related to the Lion OS X and maybe some recent EFI/firmware updates. That's why I was starting this post. I'm looking for some user succeeding with USB boot to bitlocker'd Win partition on a recent MBP running Lion OS X, just to disprove my assumption.


Currently I've managed to keep that 48 digit recovery key in mind and start typing on every boot ... but that's anything but convenient.

Reply
User profile for user: soletan
soletan Author
User level: Level 1
4 points

Mar 21, 2012 3:57 PM in response to Csound1

@csound: Using Bitlocker isn't actually requiring to drop Mac OS X. With Lion OS X installs it's basically about dropping the Recovery HD partition just to use it for Bitlocker's unencrypted bootup part. In addition I still believe using customized hybrid GPT/MBR setups it should be possible to even keep both OSX and Recovery HD partitions next to 2 Windows partitions (for Windows and Bitlocker/TrueCrypt) by dropping opportunity to access Mac OS X drive from WIndows. This can be achieved by grouping both OSX-related partitions in a single "GPT locked" partition appearing as one of four partitions in MBR (instead of two partitions - one is Win-readable OS X and one is Win-hidden Recovery HD). This enables to have two separate partitions in Windows, but I think this fixation of partition setup should be done after running Bootcamp Assistant, but prior to installing Windows actually.


In my case I simply couldn't test that much since I had to find solution without requiring re-installation of either system.

Reply
User profile for user: Csound1
Csound1
User level: Level 9
59,973 points

Mar 21, 2012 4:04 PM in response to soletan

soletan wrote:


@csound: Using Bitlocker isn't actually requiring to drop Mac OS X. With Lion OS X installs it's basically about dropping the Recovery HD partition just to use it for Bitlocker's unencrypted bootup part. In addition I still believe using customized hybrid GPT/MBR setups it should be possible to even keep both OSX and Recovery HD partitions next to 2 Windows partitions (for Windows and Bitlocker/TrueCrypt) by dropping opportunity to access Mac OS X drive from WIndows. This can be achieved by grouping both OSX-related partitions in a single "GPT locked" partition appearing as one of four partitions in MBR (instead of two partitions - one is Win-readable OS X and one is Win-hidden Recovery HD). This enables to have two separate partitions in Windows, but I think this fixation of partition setup should be done after running Bootcamp Assistant, but prior to installing Windows actually.


In my case I simply couldn't test that much since I had to find solution without requiring re-installation of either system.

I have tried that method, it failed more often than it worked and took up far too much of my time to get working, as these clients wanted encrypted Windows installations and did not use OSX there was no point in making it harder than it was.


Have you tried what you state in your post? I see a lot of 'I believes' 'I think' and 'shoulds'

Reply
User profile for user: captaincrash7
captaincrash7
User level: Level 1
0 points

Mar 22, 2012 11:36 AM in response to soletan

@soletan; same, EFI can detect the usb key no problem but, its the Bitlocker boot loader that can't access a device on a downstream hub I think. The Bitlocker bootlader has been demonstrated capable of reading a USB key in both GPT or MBR disk with other h/ware, however I would guess it wouldn't pick up the key if it was plugged in via a hub to those platforms either.


I've got refit working fine but I'm not using Lion. I'm currently exploring using DiskCryptor which can use a USB Key, but as an EFI boot device that bootstraps windows (which we know will work), opposed to Bitlocker using it its own pre-os driver.

Reply

Using USB for Bitlocker in a Bootcamp install of Windows 7 x64 Ultimate on early-2011 Macbook Pro

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.
Learn more Sign up