Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've purchased a HP Envy 15-j005ea laptop which I have upgraded to Windows 8.1 Pro. I have also removed the HDD and replaced it with a 1TB Samsung Evo 840 SSD. I now wish to encrypt the drive to protect my company's source code and my personal documents but I can't work out how to do it or if its even possible.

I gather that it is not recommended to use Truecrypt on a SSD but please correct me if I'm wrong. I also understand that the 840 Evo has built-in 256 bit AES encryption so it is recommended to use that.

The Evo has been updated to the latest EXT0BB6Q firmware and I have the latest Samsung Magician. I don't know what UEFI level I have but I do know that the machine was built in December 2013 and has the F.35 BIOS made by Insyde.

This is what I have tried:

  • Bitlocker. The latest Samsung firmware is supposedly Windows 8.1 eDrive compatible, so I followed the instructions I found in an Anandtech article. First of all it would seem the laptop has no TPM chip, so I had to allow Bitlocker to work without TPM. Once I'd done that I tried to turn Bitlocker on. Anandtech say that "If everything is eDrive compliant you won’t be asked whether or you want to encrypt all or part of the drive, after you go through the initial setup BitLocker will just be enabled. There’s no extra encryption stage (since the data is already encrypted on your SSD). If you’ve done something wrong, or some part of your system isn’t eDrive compliant, you’ll get a progress indicator and a somewhat lengthy software encryption process." Unfortunately I was asked if I want to encrypt all or part of the drive so I cancelled that.

  • Setting the ATA Password in the BIOS. I don't appear to have such an option in the BIOS, only an admin password and boot-up password.

  • Using Magician. It has a "Data Security" tab, but I don't fully understand the options and suspect that none are applicable.

enter image description here

The info in this question and answer helped but didn't answer my question.

Clearly then, what I would like to know is how do I encrypt my solid state drive in the HP Envy 15 or am I in fact out of luck? Are there any alternative options or do I have to either live without encryption or return the laptop?

There is a similar question on Anandtech but it remains unanswered.

share|improve this question
    
Encrypting SSDs is problematic due to wear leveling. I don't know all the specifics to it, but you might find a related question at Security.SE helpful. (Note that this is from a security perspective rather than implementation.) –  Jonathan Garber Dec 23 '13 at 14:15
    
Please read the comments on my post on SSD encryption: vxlabs.com/2012/12/22/… -- it has become a discussion board for people interested in SSD FDEs. I think TCG Opal that you show might be interesting. –  Charl Botha Dec 24 '13 at 13:11
    
That's a good discussion Charl, I will keep an eye on it. Looks like none of your visitors have cracked this yet. WinMagic SecureDoc Standalone for Windows is mentioned which is new to me... but I'm not sure I want to pay $100 just for the privilege of setting a password! –  Stephen Kennedy Dec 24 '13 at 14:36

4 Answers 4

I finally got this to work today and like you I believe I do not have an ATA password setup in the BIOS either (at least not that I can see). I did enable the BIOS user/admin passwords and my PC does have a TPM chip but BitLocker should work without one (USB key). Like you I was also stuck in the exact same spot at the BitLocker prompt do I want to encrypt just the data or the whole disk.

My problem was that my Windows installation was not UEFI although my Motherboard does support UEFI. You can check your installation by typing msinfo32 in the run command and checking Bios Mode. If it reads anything other than UEFI then you need to re-install windows from scratch.

Also you need to make sure that Encrypted Drive is Enabled.

Here are the steps I followed to get my EVO 840 to work with hardware encryption (Steps for installing Windows in UEFI mode and getting your drive to Encrypted Drive Enabled below).

  1. Create a Windows installation USB thumbdrive. How to Create a Bootable UEFI USB Flash Drive for Installing Windows 7, Windows 8, or Windows 8.1. This is important!! The medium must support UEFI and there are ways to create a standard boot device which does not support this and then encryption will fail!!
  2. Set Encrypted Drive to Ready to Enable in the Data Security tab of Samsung Magician.
  3. Create a bootable CD or USB drive with Secure Erase
  4. Make sure all your data is backed up, we will now proceed to wipe your drive clean!!
  5. Boot to Secure Erase and follow the steps to wipe your drive. If you get an error stating you need to unplug your drive that's OK, follow the instructions. I had that happen as well and after unplugging the power cord to the drive and plugging it back in it worked.
  6. Change the BIOS settings to disable Compatibility Mode boot devices, this is optional but it does prevent you from accidentally deploying windows 8 in non UEFI.
  7. Boot to your medium and follow these steps. How to Install Windows 8 or Windows 8.1 using the "Unified Extensible Firmware Interface" (UEFI)
  8. Install Samsung Magician. Your drive should now read Encrypted Drive = Enabled.
  9. Check your UEFI setting in windows using the mechanism I described earlier.
  10. Once you have installed windows you should now be able to re-enable using USB instead of a TPM chip and then enable BitLocker according to the Anandtech Article you posted.

These steps worked for me. Good luck!

share|improve this answer
    
Looks like a great answer! I will check it when I will get such SSD too. –  Sarge Borsch Apr 20 at 11:41
    
just checked, it really works this way –  Sarge Borsch Apr 21 at 23:13

The password has to be set in the BIOS under the ATA-security extension. Usually there's a tab in the BIOS menu titled "Security". Authentication will occur at the BIOS level, so nothing this software "wizard" does has any bearing on setting up the authentication. It's unlikely that a BIOS update will enable HDD password if it wasn't previously supported.

To say that you're setting up the encryption is misleading. The thing is that the drive is ALWAYS encrypting every bit it writes to the chips. The disk controller does this automatically. Setting a HDD password(s) to the drive is what takes your security level from zero to pretty much unbreakable. Only a maliciously-planted hardware keylogger or an NSA-sprung remote BIOS exploit could retrieve the password to authenticate ;-) <-- I guess. I'm not sure what they can do to BIOS yet. The point is it's not totally insurmountable, but depending on how the key is stored on the drive, it's the most secure method of hard drive encryption currently available. That said, it's total overkill. BitLocker is probably sufficient for most consumer security needs.

When it comes to security, I guess the question is: How much do you want?

Hardware-based full disk encryption is several orders of magnitude more secure than software-level full disk encryption like TrueCrypt. It also has the added advantage of not impeding your SSD's performance. The way SSD's stow their bits can sometimes lead to problems with software solutions. Hardware-based FDE is just less messy and more elegant and secure of an option but it hasn't "caught on" even among those who care enough to encrypt their valuable data. It's not tricky to do at all but unfortunately many BIOS's simply don't support the "HDD password" function (NOT to be confused with a simple BIOS password, which can be circumvented by amateurs). I can pretty much guarantee you without even looking in your BIOS that if you haven't found the option yet, your BIOS doesn't support it and you're out of luck. It's a firmware problem and there's nothing you can do to add the feature short of flashing your BIOS with something like hdparm which is something so irresponsible that even I wouldn't attempt it. It's nothing to do with the drive or the included software. This is a motherboard specific problem.

ATA is nothing more than a set of instructions for the BIOS. What you're trying to set is an HDD User and Master password, which will be used to authenticate to the unique key stored securely on the drive. "User" password will allow the drive to be unlocked and boot to proceed as normal. Same thing with "Master". Difference is that a "Master" password is needed to change passwords in the BIOS or erase the encryption key in the drive, which renders all its data inaccessible and irrecoverable instantly. This is called the "Secure Erase" feature. Under the protocol, a 32-bit string of characters is supported, meaning a 32-character password. Of the few laptop manufacturers that support setting an HDD password in the BIOS, most limit characters to 7 or 8. Why every BIOS company doesn't support it is beyond me. Maybe Stallman was right about proprietary BIOS.

The only laptop (pretty much no desktop BIOS supports HDD password) I know will allow you to set a full-length 32-bit HDD User and Master password is a Lenovo ThinkPad T- or W- series. Last I heard some ASUS notebooks have such an option in their BIOS. Dell limits HDD password to a weak 8 characters.

I am much more familiar with the key storage in Intel SSD's than Samsung. Intel was I believe the first to offer on-chip FDE in their drives, the 320 series and on. Although that was AES 128-bit. I haven't looked extensively into how this Samsung series implements key storage, and nobody really knows at this point. Obviously customer service was of no help to you. I get the impression only five or six people in any tech company actually know anything about the hardware they sell. Intel seemed reluctant to cough up the specifics but eventually a company rep answered somewhere in a forum. Keep in mind that for the drive-manufacturers this feature is a total afterthought. They don't know or care anything about it and neither do 99.9% percent of their customers. It's just another advertisement bullet point on the back of the box.

Hope this helps!

share|improve this answer
    
That's a lovely answer "Mr Tinfoil"; lots and lots of info, some of which I knew and some of which I certainly didn't :) I'd already concluded that I was out of luck wrt to the BIOS and its such a shame as the drive is, as you point out, already encrypting the data! I don't need NSA-proof levels of security - just enough to satisfy myself and my employer that our source code (and my personal files) would likely be safe if I lost the laptop. I'm already on the road and have gone with Bitkeeper (software level encryption) for the time being. Thanks again. –  Stephen Kennedy Jan 10 at 2:25
1  
"Hardware-based full disk encryption is several orders of magnitude more secure than software-level full disk encryption like TrueCrypt." Citation needed. –  Abdull Aug 9 at 15:11

I don't know if you saw this or fixed this yet, but here's a link specifically from Samsung on your EVO 840. http://www.samsung.com/global/business/semiconductor/minisite/SSD/global/html/about/whitepaper06.html

Essentially what they say to enable the hardware AES encryptor built into the ssd is to set the HDD Password under the System BIOS. The "User/Admin/Setup" passwords are just that. However, setting the HDD Password should pass through to the SSD. This will require you to manually enter the password every time you turn on the computer, and does not work with TPM chips or other PassKeys. Also, I cannot stress enough, ANYONE who uses encryption needs to make sure that their data is backed up. Recovering data from a failed/corrupted encrypted drive is next to impossible without going through a specialized service.

share|improve this answer

Setting the ATA Password in the BIOS. I don't appear to have such an option in the BIOS, only an admin password and boot-up password. Too bad, this is the simplest option you have.

Second is win 8.1 + bitlocker but the whole reinnstall thing is annoying

i'm not aware of any foss tcg opal sw and the paid versions probably cost a lot

truecrypt works but if your cpu doesn't have AES-NI the spees hit can be noticable

and don't forget back up your struff, encrypted data is much much harder to recover

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.