eDrive is not supported on Gigabyte X99 motherboard, despite claims to the contrary

[R-T-B]

This may not be a huge deal to some people, but I'm putting the warning out nonetheless.

I have a large balance in Bitcoins from my old mining op. As such, I keep them on encrypted HDs. My latest acquisition was a Crucial MX100 which I got with the intentions of enabling hardware encryption (edrive) with Windows 8 for my wallet file. I planned to use it with a TPM and pincode with edrive to protect them from drive/computer theft... I'm not concerned about NSA backdoors but more about the average thief making off with a large amount of my savings. So bitlocker edrive seemed ideal.

Anyhow, gigabyte says quite blatantly in their FAQ that the X99-UD3 supports it:

http://www.gigabyte.us/support-downloads/faq-page.aspx?fid=2894

However, as far as I can tell it is lacking crucial UEFI functions to support it. It actually freezes opal drive functions from boot as best I can tell and does NOT support UEFI functions necessary to do this. This made my whole purchase pretty much worthless for that goal, and I'm having to go to software encryption.

It's not a huge deal except in principle (I mean i7s have great AES speed). Still, I consider this false advertising. If there is a gigabyte rep here or something? I'd love to raise the issue with them. Otherwise, just take this as fair warning not to take the FAQ of gigabyte as truth without a good return policy.

UPDATE Nov 2015:
I thought I'd update this to let everyone know I just ran an edrive test on my system for kicks, and as of z170x, edrive support has made it into the bios on the ga-z170x-ud5.

This to me means our prompting got the edrive support into gigabytes main bios tree. Thanks everyone!

 

[Marsymars]

Signed up to reply to this, I've been having the same problem and eDrive documentation is pretty poor online.

I've been having the same problem with an A85X AMD board, and there's mention of the problem here with another board, so I suspect the problem is lack of support for EFI_STORAGE_SECURITY_COMMAND_PROTOCOL across all of Gigabyte's mobos.

Technically eDrive does work, just not for boot drives - if you boot to another disc BitLocker will happily encrypt the SSD using eDrive, at which point you can no longer boot to it.

I've had a ticket raised with Gigabyte for the past month or so. Took me a couple weeks to escalate past them trying to troubleshoot me doing something wrong on my end, at this point they've sent it off to some testing team other than support and I'm to wait indefinitely for status updates.

 

[bubbleawsome]

IIRC the only gigabyte rep is over at overclock.net

There is another one but the forum seems to be UK only and I am not able to register.

 

[R-T-B]

Yeah, I eventually ended up using the open source opal management tool msed instead. This works on gigabyte boards, albeit only in bios mode. It's also a bit tough to set up, but it works. I'd still love to see proper edrive support from Gigabyte.

 

[r0m30]

Yeah, I eventually ended up using the open source opal management tool msed instead. This works on gigabyte boards, albeit only in bios mode. It's also a bit tough to set up, but it works. I'd still love to see proper edrive support from Gigabyte.

Can I ask what you found difficult or unclear when you were setting up msed?

 

[R-T-B]

Can I ask what you found difficult or unclear when you were setting up msed?

Heh, the man himself!

It wasn't hard for me... it was more that I had to reinstall in BIOS mode. It's not your fault it's hard to make a UEFI PBA!

I tried my hand at making my own PBA using msed itself in a minimalistic environment, but I suck at it. I also can't figure out how to chainload.

Eventually, I ended up using cheapass ATA encryption on a constellation drive I had lying around and selling the SSD. It's still good enough to keep average crooks from my bitcoins.

Thanks for the tool though! I don't know if anyones told you this, but you really have pioneered open source opal work and you are a hero for that in my books.

 

[r0m30]

Heh, mostly that I had to reinstall in BIOS mode. It's not your fault it's hard to make a UEFI PBA!

I tried my hand at making my own PBA using msed itself in a minimalistic environment, but I suck at it. I also can't figure out how to chainload.

Eventually, I ended up using cheapass ATA encryption on a constellation drive I had lying around and selling the SSD. It's still good enough to keep average crooks from my bitcoins.

Thanks for the tool though!

Yes, I think chainloading is going to be difficult for UEFI systems, especially since the drive image changes when you unlock the drive. It might be possible to set up the system so that the UEFI partition is in a separate locking range that is read-only and then modify the boot to first unlock the drive and then transfer control to the original system boot code (sort of a refind lite) but I don't have the resources to develop and test a solution like that. My system doesn't have reliable UEFI support (pre win 8 vintage) so all UEFI testing is problematic.

Thanks for the feedback.

 

[R-T-B]

I just upgraded to Haswell-E so my UEFI support is pretty good if you ever need a tester... no prob on the feedback. What platform are you on, out of curiosity?

 

[r0m30]

I just upgraded to Haswell-E so my UEFI support is pretty good if you ever need a tester... no prob on the feedback. What platform are you on, out of curiosity?

Z68MA-D2H-B3 with an i7-2700k, 16G ram, there is a "beta" uefi bios available but I'm not even sure what version of UEFI it is at.

I took one look at the Win 8 preview and decided to upgrade my system so I could sit out that version of windows.

 

[R-T-B]

Windows 8 isn't bad if you cut out metro entirely... but I know what you mean... lol.

Thanks for the info. That would be an iffy era UEFI wise.

 

[kivnic]

I think I'm running into the same issue that you guys had. My motherboard is GA-F2A85XM-D3H (rev. 1.0), and Gigabyte's FAQ, and their Support responses via email, say that the motherboard does support edrive.

I have a TPM module installed, CSM disabled and UEFI bios use confirmed. I’ve followed the steps exactly for my Evo840 with Samsung Magician. However, every time I get to the step of enabling encryption I get the “Encrypt part of drive or whole drive” question indicating software-based encryption.

As a test, I installed Windows 8.1 to an old SATA drive instead and then activated bitlocker on the Samsung SSD as a secondary drive. That worked great, and when I run the command “manage-bde.exe -status f:” it confirms that the ssd is indeed hardware encrypted in this secondary drive position.

How come I can’t get it working when the SSD is the primary drive? Is there a way I can definitively check to see if the motherboard supports EFI_STORAGE_SECURITY_COMMAND_PROTOCOL ?

 

[Marsymars]

Same mobo as me except I've got the rev 1.1.

It's pretty clearly a BIOS or hardware issue that affects Gigabyte boards across multiple chipsets.

No way that I know of to check support for EFI_STORAGE_SECURITY_COMMAND_PROTOCOL.

I'm just going to keep submitting support tickets to Gigabyte and rating them as extremely unhelpful until they either fix it, or confirm that it's a problem on their end and update their site to stop claiming eDrive compatibility.

When you're running tests for hardware v software encryption, you can save a bit of time by forcing hardware Bitlocker encryption for OS drives via group policy editor - Bitlocker actually runs the test to check for this as soon as you go to enable, so you don't have to go through saving the key and getting the "encrypt part or whole question", it just immediately fails with no software fallback.

 

[R-T-B]

Yeah, I hope they fix it someday but I gave up waiting sadly... Got an ASUS x99-A and it works fine.

 

[kivnic]

I wanted to close out my question on this thread. Amazingly, Gigabyte produced a new BIOS for me that correctly enabled edrive support. It's now working.

It was a bit of a frustrating ordeal:

• 3/13/2015 - Opened the support request
• 5/12/2015 - Solution received
• 20 - number of emails exchanged, not county many many screenshots and hours and hours or reinstalling windows.

Yeah, this was a huge hassle, but I'm glad Gigabyte came through eventually.

 

[R-T-B]

I wanted to close out my question on this thread. Amazingly, Gigabyte produced a new BIOS for me that correctly enabled edrive support. It's now working.

It was a bit of a frustrating ordeal:

• 3/13/2015 - Opened the support request
• 5/12/2015 - Solution received
• 20 - number of emails exchanged, not county many many screenshots and hours and hours or reinstalling windows.

Yeah, this was a huge hassle, but I'm glad Gigabyte came through eventually.

That's great! What bios version if I may ask?

 

[kivnic]

It's bios version 2A85XMD3.F4f. The last one they have published on the website right now is F4e, so maybe F4f didn't go through QA or Gigabyte doesn't want to deal with the additional support contacts a new release might generate.

Tried to post the file on the forum here, but even RAR'd the file is about 3.4mb and I guess that's larger than what's accepted for upload.

GA-F2A85XM-D3H (rev. 1.0) -
http://www.gigabyte.com/products/product-page.aspx?pid=4383#bios

 

[Marsymars]

Followed up with Gigabyte about my support thread, got F4f from them, confirmed that it fixes the issue for me as well.

 

[R-T-B]

Great to hear! Thanks guys, with any luck this will make it into the main tree for their future boards and bioses, helping everyone in the long run.

 

[ShiBDiB]

Semi on topic. Why don't you just put ur wallet on a thumbdrive? Someone would need to physically break into ur home and find said thumbdrive, plus u could just encrypt that as well.

 

[R-T-B]

Semi on topic. Why don't you just put ur wallet on a thumbdrive? Someone would need to physically break into ur home and find said thumbdrive, plus u could just encrypt that as well.

Considering the earnings are well into the realm of retirement if I am frugal (I currently don't even have to work, but probably should anyways), I'm slightly concerned about even someone getting that desperate as to resort to physical theft (my mining commenced from my home ip which is pretty accurately geoip accessible, and all over the internet).

Plus... heck I'll be brutally honest: Technology is fun.

 

[Caring1]

Semi on topic. Why don't you just put ur wallet on a thumbdrive? Someone would need to physically break into ur home and find said thumbdrive, plus u could just encrypt that as well.

I wouldn't trust a thumb drive to retain crucial data, degradation over time can render them useless.
Imagine deciding to cash in some coins and finding the drive corrupted or blank.

 

[R-T-B]

I wouldn't trust a thumb drive to retain crucial data, degradation over time can render them useless.
Imagine deciding to cash in some coins and finding the drive corrupted or blank.

That just sent chills down my spine thinking of it.

That said, I actually have most of my holdings in cash/bank now, but yeah... don't want that even for what I have left. It'd be a painful thing for sure.

 

[ShiBDiB]

I wouldn't trust a thumb drive to retain crucial data, degradation over time can render them useless.
Imagine deciding to cash in some coins and finding the drive corrupted or blank.

So make backups? Hard drives fail all the time, thumb drives degrade with constant usage which shouldn't be the case here as it should be locked in a safe.

If you're actually concerned to the point where you think someone will geolocate your IP and rob you, than leaving anything on a drive that's attached to a networked computer regardless of encryption is putting you in an even more worse off situation.

Me personally I'd have already moved any bitcoin assets into something that isn't a single US law away from crashing to pennies on the dollar.

 

[R-T-B]

Me personally I'd have already moved any bitcoin assets into something that isn't a single US law away from crashing to pennies on the dollar.

As mentioned, already done. It's crashed enough for me to get that picture straight (I dumped most of them into USD at $300),. My remaining bitcoins (not much overall) represent my high risk assets... sorta a fun gamble at this point. I mean, it's not likely but heck, why not keep a few to see if they don't become the currency of the future? (nah, I don't buy that idea either, but who knows?).

At the time I wrote that post, I was concerned to that level and the PC in question was off the network (on a mirrored drive array) and I had good reason to be paranoid. However, I don't really have this concern anymore, I just like the tech and don't mind seeing more encryption features for consumers in general.

But we are way off topic now.

 

[R-T-B]

I thought I'd update this to let everyone know I just ran an edrive test on my system for kicks, and as of z170x, edrive support has made it into the bios on the ga-z170x-ud5.

This to me means our prompting got the edrive support into gigabytes main bios tree. Thanks everyone!