Requirements for Protecting the System Volume with BitLocker

To enable BitLocker to protect the system volume on a Windows 7 computer, the computer must meet the following requirements:

• Unless you plan to rely solely on a USB startup key, the computer must have a TPM 1.2 module (revision 85 or later), and it must be enabled. (TPM chips can be disabled by default and can be turned on using the computer's BIOS.) The TPM provides bootprocess integrity measurement and reporting.
• The computer must have a version 1.21 (revision 0.24 or later), TCG-compliant BIOS with support for TCG specified Static Root Trust Measurement (SRTM) to establish a chain of trust prior to starting Windows.
• If you plan to use a USB startup key, the BIOS must support the USB Mass Storage Device Class2, including both reading and writing small files on a USB flash drive in the preoperating system environment.
• The computer must have at least two volumes to operate. Windows 7 setup automatically configures volumes to meet these requirements. On computers running Windows Vista, you can use the BitLocker Drive Preparation Tool, available at http://www.microsoft.com/downloads, to modify existing partitions to meet these requirements:
  • The boot volume is the volume that contains the Windows operating system and its support files; it must be formatted with NTFS. Data on this volume is protected by BitLocker.
  • The system volume is the volume that contains the hardware-specific files needed to load Windows 7 computers after the BIOS has booted the platform. For BitLocker to work, the system volume must not be encrypted, must differ from the operating system volume, and must be formatted with NTFS. Your system volume should be at least 100 MB. Data written to this volume-including additional user data-is not protected by BitLocker.

You can have multiple instances of Windows Vista or Windows 7 installed on a computer with a BitLocker-encrypted volume, and they will all be able to access the volume if you enter the respective recovery password every time you need to access the volume from a different partition. You can also install earlier versions of Windows on volumes not encrypted with BitLocker. However, earlier versions of Windows will not be able to access the BitLockerencrypted volume.