1

I have an MSI GT60-2OD (Haswell MB, UEFI enabled w/o CSM) with 3 Samsung EVO 840 mSATA SSD drives in RAID 0 mode (Intel RST AHCI RAID Controller Miniport aka Intel(R) Mobile Express Chipset SATA RAID Controller, SATA mode is 'RAID' and not 'AHCI' in "BIOS"). This works fine as such.

I thought that the eDrive compatibility of the EVO 840 mSATA would allow me to use Bitlocker encryption natively in the SSD hardware controller, so there would be no performance penalty. Because Windows only sees the Intel RST Raid Controller volume and not the actual SSD's, this doesn't work (Windows wants to enable software encryption, which I don't want). I found documentary evidence of the lack of support for this on MS Technet and at the Intel website.

The question is whether it is then possible at all to enable the native "Self Encrypting Drive" (SED) of the SSD's in this configuration? I would speculate this is by putting a user/admin password in the security tab of the "BIOS" menu and enabling the "Secure Boot menu" with secure boot mode "standard", but I cannot find any documentary evidence that this would actually enable the SED functionality of the 3 SSD's behind the Intel RAID controller.

1

1 Answer 1

3

The native Self Encrypting Drive function is always on. This means that the data on the ssd is always encrypted, however by default it has no password set. It has an internal hash which is accessed using the BIOS password you give when booting up. The motherboard needs to have HDD BIOS lock option for you to enter the password, which most older desktop motherboards don't have, but most laptops (even older ones) have.

RAID function is problematic, wasn't too long ago when Intel made available TRIM passthrough for RAID 1, and more recently RAID 0. Basically eDrive technology would have to be implemented in Intel drivers too, and this is probably very tricky when going for RAID 0. While I'm not that knowledgeable on the subject, it would appear near impossible as with the current implementation.

Windows software RAID 0 is another possibility, and this enables the hard drives to be in AHCI mode allowing passthrough of edrive commands. However I'm not aware of hardware level bitlocker support in software raid mode. You'll have to try it out. Generally speaking speed difference between this type of "hardware" raid and software is negligible. True server-quality RAID implementations is another matter.

In short, use BIOS HD password (usually named this way despite using UEFI, aka ATA-password) if you wish to use Intel RAID, but you will miss out on eDrive. If you want eDrive, try out software raid which may or may not work.

Also, assuming that there is no clear "HD PASSWORD" type of setting in the UEFI BIOS, and BIOS level HD-passwording is not documented, you may want to try placing a general start-up password and extracting the disk and testing it on another computer or using an external USB-enclosure. It should not boot up nor register in windows if it has a password lock, ie. it appears to be dead. Secure boot function does not affect user passwords, but is rather a communication layer between the hardware and OS and as such does not affect this problem.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .