up vote 2 down vote favorite
share [g+] share [fb]

For the sake of my privacy I'd like to boot my computer or windows only with the help of an external storage media.
Is this even possible? If so, then how?

link|improve this question
73% accept rate
2  
So, from this and your comment on the first answer, what you need is some form of full disk encryption that uses key information provided on removable media? – DMA57361♦ Dec 20 '10 at 19:52
Just boot with keys. Encryption is optional and I'd rather not have it because it affects disk performance, and my HDD is very slow as it is. – Vercas Dec 21 '10 at 12:36
feedback

2 Answers

up vote 2 down vote accepted

Assuming DMA57361's assessment of your needs in the comments are correct, BitLocker will let you do full-drive encryption with decryption credentials stored on USB key. There are other solutions as well (TrueCrypt I think has the same functionality) but I suggest BitLocker as being baked into Windows already. ;)

I am not aware of any tools that simply lock the bootloader to a key without actually encrypting the drive. (If you're concerned about your data, you'd have to encrypt the drive anyway to keep people from just booting to a LiveCD or even just taking the drive.)

EDIT: To enable BitLocker, you need to be running Vista or 7 Ultimate for BitLocker. It's pretty straightforward - put 'BitLocker' in the Start Menu, find the drive in question and enable BitLocker and follow the steps.

If your machine DOESN'T have a TPM, you may need to make a group policy change to allow this. Vista directions here, 7 directions here.

link|improve this answer
Our work laptops are whole disk encrypted with Truecrypt and you can only boot them by inserting a Yubikey and giving it a long (> 4 sec) press to make it enter its code. The keys are $25 each from here: yubico.com/yubikey – Linker3000 Dec 20 '10 at 21:33
It tells me that there is no (compatible) TPM detected and nothing initializes (the progress bar just stops the marquee animation). I already use BitLocker a lot to encrypt my USB flash drives. – Vercas Dec 21 '10 at 11:43
That yubikey think is interesting but I am just 15 years old and I can't but anything. – Vercas Dec 21 '10 at 12:38
Any idea how to enable the BitLocker? – Vercas Dec 21 '10 at 14:33
Well, let me satisfy your curiosity with two answers: First and most importantly, everyone here knows how to hack into a computer (lack of education) and I am a programmer. I am very proud of my work because I've managed to accomplish things that most of "the elders" have not, and the jackals know it. It's just a matter of time before they hack into my network. Secondly, my parents and brother invite many people in the house and they ALL use my computer, and I can't password my account because of my parents. I am afraid of theft... – Vercas Dec 21 '10 at 17:01
show 5 more comments
feedback
up vote 0 down vote

Enter BIOS, set boot devices as USB. If you have an option for second & third boot devices - keep it as network or none.

link|improve this answer
This is just what I don't need. As a matter of fact, I already have that setting, but I want my computer to boot only with an external media in (containing, let's say, a key file). – Vercas Dec 20 '10 at 19:45
1  
I'm not sure if it's possible with Windows. If you were using Linux you could probably write the bootloader to a USB flash disk. Win 7 creates a separate boot partition, but I'm not sure if you can make Windows write the boot loader to a USB flash disk. – Sathya♦ Dec 20 '10 at 19:52
I was looking for a less violent way than moving the boot loader. Something like checking for a key file in peripherial devices. But... meh... too bad. – Vercas Dec 20 '10 at 20:17
2  
@Sathya - Note that the separate boot partition in Win7 is NOT a requirement. It'll install just fine on a single partition system, it's just that the installer won't really let you do that. Here's the trick - when installing the OS, do a 'Custom' install, format and select the drive you want to install to. It'll create the two partitions (the small 'System Reserved' one and the full-sized normal drive). Delete the larger one and manually add the space to the smaller one, then install on it. Voila, single-partition Windows 7. – Shinrai Dec 21 '10 at 15:22
Uh, all that said, I still think you're correct in that it can't easily be written elsewhere, of course. ;) – Shinrai Dec 21 '10 at 15:23
show 1 more comment
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.