Bitlocker eDrive on new X1 Carbon

[bhendric]

I recently received X240 and new X1 Carbon (Gen2) laptops with the 256GB eDrive and am working to set up Bitlocker using Windows 8.1.

On the X240, I followed the steps in another posting here and successfully got hardware AES working (by manually installing chipset on newly installed OS, then installed everything except RST and Bitlocker worked with the eDrive).

Following the same process on the new X1 Carbon, however, I only am able to use software encryption and can't figure out what to do to use the eDrive feature.

Is there a process to follow on the new X1 Carbon Gen 2?

Thanks!

[someotherguy · Accepted solution]

It should be the same process.  Check to see if the eDrive got enabled during your clean install of Win8.1:  reboot into BIOS setup, go to the Security -> Password menu, do you see an option to set the HDD password?  

HDD password option exists = eDrive not enabled

HDD password option not exists = eDrive enabled

If eDrive is NOT enabled, you need to clean-install the OS again.  Make sure you clean the disk in DISKPART, first.  Windows does not enable eDrive except for when it creates partitions on an empty drive.

[bhendric]

Yes, thank you. I ended up using diskpart and cleaned the drive, then re-installed Windows 8.1. That seemed to do the trick. Simply deleting the partitions was not enough on the X1 Carbon. However, on the X240 it was. I will make it a point to avoid issues by using diskpart to clean drives regardless of laptop model going forward. Thanks!

[warder]

I think the fact that it can ONLY be enabled on a clean Windows install is one of the least documented requirements. Unlike regular bitlocker which you can do anytime. I have no idea why this is but it is.

[someotherguy]

---

warder wrote:
I think the fact that it can ONLY be enabled on a clean Windows install is one of the least documented requirements. Unlike regular bitlocker which you can do anytime. I have no idea why this is but it is.

---

There is not any technical requirement for this; it is just Microsoft's bad implementation of hardware encryption which requires this.  If you were to use the OPAL function of the drive, you could use 3rd-party SW (like WinMagic SecureDoc) to turn on and off the hardware encryption after the OS is deployed.  Not so with Microsoft and HW-mode BitLocker.