TrueCrypt on Macbook Windows XP

Everyday's findings

Thursday, November 20. 2008

TrueCrypt on Macbook Windows XP

How to get Truecrypt with boot encryption working on any intel Mac:

Update (2009_05_18): I appears as if you indeed need rEFIt to synchronise GPT and DOS partition tables. Else formatting the Mac partition sometimes ruins your freshly installed Windows.

You are running your MacBook (Pro, Air) under Windows XP? You do not want the TSAWWeveryone and their cat rummaging through your personal documents once you're away or in the unlikely event the Macbook gets stolen? That's what Truecrypt was made for.

To get it up and running, it needs some work, but nothing complicated.

Not working?
Truecrypt can encrypt your entire NTFS boot partition, so nobody can read your stuff if he gains physical access to your Notebook. Unfortunately encrypting windows' boot partition doesn't work with Bootcamp, because truecrypt expects the Windows partition to be the first on the harddisk. Bootcamp however wants the windows partition to be the last one on the disk.

Of course it works!
The solution is simply based on the fact that you don't need Bootcamp at all to run Windows on any intel Mac. There's an easy way to avoid Bootcamp if you know what to do. I won't elaborate into great detail about the particular steps as they are rather mundane.

What you want to do is put your existing (or a fresh one) Windows on the first partition of your harddisk and place everything else behind it. You can as well have a triple boot with Windows first, Linux as second choice and Mac OS as third. So we are rebuilding our partition layout and once XP is running off the first partition, we let TrueCrypt do the rest.

The only thing you need is an external harddisk (for storing the backups), a Windows XP CD (for re-partitioning) and -- if you want a Linux as well -- a bootable Linux Distribution CD/DVD.

Here's the bullet list:
  • if you still need Mac OS on the internal harddisk: back up your Mac OS as a bootable copy on the external harddisk (with Carbon Copy Cloner, SuperDuper or whatever pleases you)
  • back up your Windows with WinClone on the external disk
  • boot off the Windows CD
  • delete every partition on the disk with the windows installer
  • create a new partition large enough for your windows installation
  • leave some of the disk free after the windows partition if you still want Mac OS
  • let the installer format the partition
  • In case you don't have a Windows installation yet, let the installer do its work until he's finished
  • reboot and start Mac OS off the external disk
  • If you already had a windows installation: restore the Windows Backup onto the new partition
  • Create a Mac OS partition. You have to do this by command line via diskutil
  • restore Mac OS on this partition
We're almost done. But as the partition scheme has changed, XP's boot.ini doesn't reflect the actual partition numbering. Let's fix this:
  • boot off the Windows CD again, go into rescue mode
  • execute "fixboot"
  • et voilá!
Posted by Dirk Taggesell in Misc at 21:04 | Comments (24) | Trackbacks (3)

Trackbacks
Trackback specific URI for this entry

Encrypt Windows 7 system drive in BootCamp / on a Mac
Encrypt Windows 7 system drive in BootCamp / on a Mac
Weblog: Claes Brandt
Tracked: Feb 17, 23:50
Encrypt Windows 7 system drive while dual booting Windows / Mac OS (not bootcamp)
Encrypt Windows 7 system drive while dual booting Windows / Mac OS (not bootcamp)
Weblog: Claes Brandt
Tracked: Feb 17, 23:51
Dual boot Windows 7 and Mac OS X while encrypting windows system drive (not bootcamp)
Dual boot Windows 7 and Mac OS X while encrypting windows system drive (not bootcamp)
Weblog: Claes Brandt
Tracked: Feb 18, 22:03

Comments
Display comments as (Linear | Threaded)

Hi, thanks alot for this information, no one else has answered it so far! I just have a couple of questions:

1.how do i restore mac OS back to an empty partition?

2.Once this is all done, am i able to use bootcamp? because i need to be able to boot either OS,and if so, how does it all work? i.e does the mac prompt me for the truecrypt password at boot, then load the bootcamp OS selection screen afterwards?
#1 Peter Arb (Homepage) on 2008-12-25 21:28 (Reply)
If you have a working Mac OS - e.g. on an external drive - you can use Carbon Copy Cloner (www.bombich.com) or other tools like SuperDuper to restore Mac OS on any empty partition.

And you don't need no bootcamp anymore. In fact Bootcamp is preventing Truecrypt from working because Bootcamp creates the Windows partition as the last one on the disk while Truecrypt expects it the first one.

Before I did all the magic I (inadvertedly for this) had ReFit (refit.sourceforge.net) installed on the Mac, which acts as an additional boot menu. Hence I do not know for sure whether it also works without ReFit - with the OpenFirmware boot menu alone.
#1.1 Dirk Taggesell on 2008-12-26 19:17 (Reply)
Great! this is exactly what I was looking for.

Question though... is it possible to somehow do full disk encryption of the mac partition also?

Or I guess is FileVault good enough? Does OSX write anything containing data - like hibernate or temporary files - outside of the user folder?
#2 Mark on 2009-02-21 14:52 (Reply)
Yes, the FileVault only encrypts the user's folder.

But you can at least have the OS encrypt the swap file. Go to "Security" in Preferences and activate "Use secure virtual memory".

Unfortunately temporary files in /tmp and elsewhere still seems not to be encrypted.

Some details and issues regarding FileVault can be read here:
http://en.wikipedia.org/wiki/FileVault

There's some commercial solutions for full disk encryption on Mac OS X, though I haven't used any of them:
http://www.checkpoint.com/press/2008/fdemac052808.html

http://www.pgp.com/products/wholediskencryption/
#2.1 Dirk Taggesell on 2009-02-21 20:35 (Reply)
Using the guide above (thanks Dirk) I was able to swap the order of the partitions, moving my Vista partition to be the first partition on my drive. A couple of things to mention:
1 - I also used Refit to give me a nice boot option screen at startup before I did this. After swapping the partitions, Refit continues to work perfectly. I'm not sure how things would work without Refit though, I just know it worked with Refit.
2 - After backing up both OS's (OSX using Carbon Copy Cloner and Vista using WinClone) I wiped the drive of partitions as Dirk suggested. I then had to create a new Windows parition, and a second partition for Mac OSX. I then booted into OSX and reformatted that partition using Disk Utility.
3 - After copying my Vista backup image back onto the newly created Windows partition, I couldn't get it to start up. No startup repair I did could repair this (I tried everything I could possibly find, including all of Vista's startup repair tools and command-line options). I was forced to do a clean install of Vista and then put my data back on.

Those were the few issues I faced, which are small potatoes compared to the benefit of being able to encrypt my drive using TrueCrypt, and use Acronis True Image Workstation properly (it too had issues with the Windows partition being the second partition on the drive).

So I'm up and running. It works, and I thought my experiences might help others reading this in the future!

Good Luck
#3 Cam on 2009-02-23 07:53 (Reply)
I can only tell for Win XP as I dont't have Vista. The reason for not booting after transferring Windows to the first partition lies in c:\boot.ini:
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional"

The above is how it looks when its the first partition. Installed on the second partition "partition(1)" should read "partition(2)". Hence manually changing boot ini to "partition(1)" might help -- if there's still a boot.ini under Vista. Which I'm not sure of.
#3.1 Dirk Taggesell on 2009-02-24 22:35 (Reply)
Many thanks for this unique solution - it's just what I was looking for. The one thing the post is missing is to complete the steps in actually getting TrueCrypt to secure the Windows partition...

I have a new MacBook Pro cleaned out of the box with 3 Partitions:
1) 16GB (NTFS) Windows XP
2) 16GB (FAT32) currently unused
3) ~212GB (HFS+) OS X Leopard

I did the XP install, then booted from external disk and restored a clean Leopard install to the 3rd partition, installed rEFIt 0.12, fixed Windows booting and had a perfectly running Dual-boot (plus VMWare Fusion) setup.

Then I booted native into Windows and installed TrueCrypt 1.6a and chose to encrypt the system partition. The Test went well installing the TrueCrypt Bootloader and the disk encrypted just fine. After rebooting the machine the Windows Partition was gone from rEFIt making it impossible to boot. Booting OSX VMWare also could not use the partition anymore. From TrueCrypt in OSX I could mount the Windows system partition without issue and everything was intact, so just booting is the issue.

How can I make rEFIt happy after encrypting Windows? And as an extended wish, VMWare Fusion (or Parallels)? I looked for a way using the rEFIt shell to manually specify a parition but came up empty.

I have cycled several times, doing a full decrypt, dual-boot is fine again, encrypt system partition and Windows is lost, etc, etc.

Any help would be greatly appreciated. Thanks.
#4 Kyle on 2009-03-07 22:52 (Reply)
It was all long ago when I did this, so I'm not entirely sure, but maybe the refit gets in the way. I can only say it did work for me. Maybe removing refit will do. Sorry for not being able to give a clearer answer.

For VMWare not being able to boot off the truecrypted windows, I cannot tell anything neither.
#4.1 Dirk Taggesell on 2009-03-08 17:42 (Reply)
Did you select single-boot or multi-boot during the wizard? For example:
(http://www.randyjensenonline.com/blog/wp-content/uploads/2008/04/truecrypt4.jpg)

I tried with multi-boot and faced the very same problems. After I selected a single-boot choice, I could boot the windows partition by pressing the option (alt) and selecting the windows disk as a boot disk.
#4.2 hanu (Homepage) on 2009-03-31 13:55 (Reply)
I think, I selected single-boot, as windows doesn't know about other OS' on the machine and there's neither the typical lilo or grub boot mechanism in place.

All the booting is being done by Apple's OpenFirmware, and maybe the rEFIt boot manager as well.

So I would chose single-boot.
#4.2.1 Dirk Taggesell on 2009-03-31 19:25 (Reply)
Great article, will this same process work for Vista in place of XP?

Thanks
#5 Ben on 2009-03-27 04:42 (Reply)
It should. Haven't tried it though.
#5.1 Dirk Taggesell on 2009-03-27 10:37 (Reply)
Great stuff, will try it out later.
Thanks Dirk !!!
#6 MZ on 2009-05-18 16:57 (Reply)
Hi all,

Perhaps you can help with a situation that I would like to set up.

I would like to partition my MBP as follows (order not important):
1) WinXP partition of say 20GB
2) Mac OS X partition of say 20GB
3) Common data partition of the rest (around 280GB)

The trick is that I want the common data partition to be TrueCrypted and accessible (both read and write) from both operating systems.

Anyone have any pointers on how to do this? I've searched the web and come up empty with a solution that works.

I have been able to do the file container type encryption with TC but I want to try the partition method.

Any tips (or references to other articles that help) would be greatly appreciated. The biggest issue I have is when doing the trial-and-error approach that I have been using up to now is that the windows install takes forever (I'll do a clone in future though :-).

Thanks and regards
Swalt
#7 Swalt (Homepage) on 2009-07-05 13:09 (Reply)
The sophisticated way would be to re-partition the Mac harddisk to have a third partition, but that will most likely break Bootcamp booting and is quite some work - as I described here.

You could make your life easier and use Bootcamp to make (quite some) room for Windows, place the TrueCrypt Volume as a simple file on the NTFS partition and install an NTFS drive on the Mac side that is able to read AND write.
Like http://code.google.com/p/macfuse/ for instance. I haven't tried MacFuse with NTFS though.

Thus you would have windows and Mac OS along with a TC volume, accessible by both OS'.
#7.1 Dirk Taggesell on 2009-07-06 20:59 (Reply)
Hi,

i don't know how to make a mac partition, and google doesn't help :-(

I think this is because of my (mayybe) wrong kewords.

Could you please give me a link to a tutorial?

Thanks
#8 Florian Schächter on 2009-08-14 11:00 (Reply)
Hello, I´ve done all things but after I restore on another partition MacOSX I cant select the Windows partition in bootmenue screen... but Windows is still there, I havent deleted it... but I cant boot from the partition and so I cant go into rescue mode for fixboot (because I cant start the CD if I cant go into windows)
#9 Helper on 2009-09-07 05:55 (Reply)
I´ve executed fixboot now after I could access the CD.

But there isn´t a windows partition as bootable marked in the boot-up screen...

How can I tell my mac to boot from the windows partition ?

I cant select it at the boot-up menue...
#10 Helper on 2009-09-07 06:09 (Reply)
Everything is fixed now !

I´ve reinstalled Windows and now the boot-loader screen is showing me both partitions !

thanks for this manuel !

thanks thanks thanks
#11 Helper on 2009-09-07 06:27 (Reply)
I am trying the whole day to setup:
partition 1: min. 32KB for truecrypt loader
partition 2: windows 7 partition
partition 3: mac partition

Mac can't format partition 3 since it has MBR not GUI partition tables. I converted to GPT but formatting with apple hd util fails.

Question Do I need MBR/GPT or hybrid for my configuration?
#12 Kai on 2009-10-22 01:00 (Reply)
Yes, it appears as if you need rEFIt to sync the MBR partition table with the GPT table.
#12.1 Dirk Taggesell on 2009-10-29 20:16 (Reply)
Hey guys i still need your help. There are a lot of users how done it so, i would like to ask you what to do after restoring windows. I know have to do a mac partition i think. But its now MBR and this doesn't work...

I hope you can answer me.
#13 Florian Schächter on 2009-11-02 20:55 (Reply)
I just followed this guide and successfully encrypted my Windows partition with TrueCrypt. For me following all the steps works well except using rEFit. I couldn't boot to Windows until AFTER I uninstalled it. Besides that, everything went smoothly. Keep in mind MBR is fine and Snow Leopard (and I'm assuming Leopard) will boot from it without any problems.
#14 Brad on 2011-02-25 04:15 (Reply)
Just did the install with windows 7 and snow leopard. Got truecrypt working perfectly!!! I used the guide above and the one found here:

http://blog.claesbrandt.dk/post/Dual-Boot-Windows-Mac-Encrypt-Windows-With-Truecrypt.aspx

Tip:
I needed to install rEFIt in order complete the step to get the windows partion to boot. I already had windows in place. I backed up and restored with winclone. I am not sure that you if you will need rEFIt if you do a fresh install of windows. rEFIt is a much nice boot loader then the mac one anyway.

My steps:
1. Backup mac with carbon copy cloner to a USB drive.
2. Backup windows boot camp install with Wincloan on the MAC to the USB.
3. Boot with the windows disk, delete all partitions on the internal hard drive. Create 2 new ones one for windows and one for MAc. I had to create both so that the restore of the windows via wincloan would not install at the end of the drive. I made the second one just as a place holder. There will be a third partition that will be created automatically by the windows 7 CD at the beginning of the drive, just ignore that for now.
5. Boot to the MAC OS you copied over to USB.
6. Restore the windows to the first partition on the Hard drive via wincloan.
7. Restore the mac to the second partition on the drive via carbon copy cloner.
- use the Mac diskutil to format the second drive as a Mac Extended format.
8. Unplug the USB and Boot to the Mac OS that is now on the second partition of the insternal drive and install rEFIt.
9. Boot to the windows 7 CD and repair the start up 3,4 times.
10 . After that is done you should now be able to boot windows via to the first windows partion in rEFIt.
11. Install truecrypt.
12. After installation refit should now only have one MAC OS and one windows. Truecrypt should work as normal.
#15 John Fox (Homepage) on 2011-06-22 03:54 (Reply)

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.
E-Mail addresses will not be displayed and will only be used for E-Mail notifications

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA 1CAPTCHA 2CAPTCHA 3CAPTCHA 4CAPTCHA 5
 
 

Quicksearch

Archives

May 2013
April 2013
March 2013
Recent...
Older...

Syndicate This Blog

Powered by

Serendipity PHP Weblog

Top Referrers

finasteride.beep.com (189)
www.everyoneweb.com (33)
www.google.com (33)
ukpropecia.blinkweb.com (30)
www.beeplog.com (29)
world-ed.jw.lt (27)
lelevitra.npage.eu (18)
www.galeon.com (18)
adarutojp.web.fc2.com (15)
getpropecia.blinkweb.com (15)