BitLocker Drive Encryption is a feature of Windows Vista Ultimate and Windows Server 2008, which offers full disk encryption on the level of logical volumes (e.g., C:). As it uses AES 128 by default and the only publicly known way to defeat programs like BitLocker or TrueCrypt (if properly configured) is the famous (but easily preventable) cold boot attack, I’d really recommend using it if you are not a follower of the “Microsoft is pure evil” cult. Needless to say, even the strongest disk encryption is only as good as the password or key mechanism you use. In the following, I will describe a little-known option which was introduced with Service Pack 1 for Vista and massively aggravates attacks based on keyloggers or stolen USB sticks.

Most likely, someone who wants to get hold of your encrypted data will neither try to break the encryption algorithm nor its implementation. Instead, he will try to defeat the authentication mechanism by eavesdropping your password (“what you know”) or stealing your physical key (“what you have”). In its initial version, BitLocker forced you to choose between TPM¹ only, TPM + PIN, TPM + USB Key or USB Key only. So it was either something you knew (your PIN) or something you had (your USB key) which protected your data and made BitLocker decrypt your volumes on the fly as you booted your computer.

To the great relief of any paranoid encryption junkie, Microsoft decided to add another mode, which requires TPM + PIN + USB Key to start up your computer. This feature was introduced with Service Pack 1 for Vista and makes it really hard for an attacker to get hold of your authentication details if you don’t write your PIN on your USB stick or get “questioned” by someone with a blow torch and a pair of pliers.

So how does it work? Well, although there is no GUI option for this new mode, it’s surprisingly simple to activate:

1. Click on the Vista logo / start button.
2. Type cmd in the search box and do NOT hit enter.
3. Right-click on the command prompt item (cmd.exe) and select “Run as administrator” from the context menu.
4. Enter cscript manage-bde.wsf -on c: -rp -rk d: -tpsk -tp 1234567 -tsk e: and hit enter.
   (“c:” is the drive which you want to encrypt / your OS volume; “d:” is the drive where the recovery key will be stored at; “1234567” is your secret PIN, which can consist of up to 20 digits; “e:” is your USB key.)
5. Write down the recovery password and hide it at a SAFE location (e.g., under your keyboard ).
6. Type exit and hit enter.
7. DONE!

That’s it! I’d strongly recommend leaving your computer in peace until BitLocker has finished encrypting your drive, although the manual states that you can even reboot without causing any trouble. Well, I’m not exactly sure that an accidental BSOD (Blue Screen of Death) caused by your favorite first-person shooter won’t interfere with the encryption process…

Upon the next reboot, you will be asked for your secret PIN and the USB key, providing you with the maximum level of authentication-based security which BitLocker has to offer at the moment.