Windows – BitLocker unlock D: with a unique password prompt on Windows start

biosbitlockerencryptionwindowswindows 7

My personal data is in D:\, which is BitLocker-ed with a password. On Windows 7 boot, a few programs in Startup should access to D:\, such as the wonderful Everything indexing software. How to have a prompt for the password to BitLocker-unlock D:\ before the programs in Startup shortcuts start?

Sidenote: my Windows Desktop is configured to be on the data partition: D:\Desktop\ (private documents are sometimes stored on Desktop so I really want it to be on BitLocker-ed D:\ ), so on each Windows startup, the desktop cannot be displayed: D:\Desktop is not accessible. Access is denied and no Desktop can be displayed until I manually unlock D:\.

I've solved this problem by:

  • configuring to "auto-unlock" D:\ , but for this it was mandatory to do this:

  • encrypting C:\ too (but that does not contain much personal data, I mostly use portable software installed in D:\ ). If C:\ is not encrypted, you cannot configure the auto-unlock of D:\ (The operating system drive must be protected by BitLocker to automatically unlock a fixed data drive)

But then having C:\ encrypted has several drawbacks:

  • anytime I change something in BIOS, I have to re-enter manually the Bitlocker recovery key (I wanted to put a password instead of a long recovery key with manage-bde -add -password but this was not possible on the OS partition, since TPM was already enabled).

  • I have to use the laptop's BIOS password system to lock the PC and prevent access by someone unauthorized

  • each time you modifiy things related to boot (e.g. UEFI), it gets more complicated and you need to enter the recovery key again and again

I'd like to simplify all this instead and have:

  • C:\ uncrypted
  • no password in laptop's BIOS
  • D:\ BitLocker encrypted with a password
  • Have a single password prompt on startup of Windows, before the programs in "Startup" start

How to do that?

Best Answer

BitLocker is too restrictive and problematic.

I would recommend using instead a third-party product such as VeraCrypt.

You may encrypt the entire disk D, or just a part of the disk in the format of a file, or even encrypt and use what looks like the unallocated space at the end of the physical disk.

You can schedule a VeraCrypt mount command for the disk on logon to force entering the password, or just do that from a shortcut on the desktop when access to D is required.

Using VeraCrypt would give you much better control and less restrictions.

Related Question