Take the 2-minute tour ×

What I need in a nutshell:

  1. Boot Windows PE from a USB drive
  2. Encrypt a custom script which has a password in it which is within the WIN PE ISO
  3. Ideally the boot will be password protected (not necessary)
  4. The USB drive needs to have available storage for portable Windows programs
  5. The whole boot process needs to be straight forward and reproduction onto multiple drives needs to be simple
  6. The solution needs to run on a standard (cheap) USB drive, no hardware encryption.

The reason for this is that if the USB drive is stolen, the password must not be accessible.

What I have tried so far:

  • I can get 1, 4, 5 & 6 using YUMI (http://www.pendrivelinux.com/yumi-multiboot-usb-creator/)
  • I have looked into Truecrypt's System Encryption option, but can't see a way of doing this with Windows PE

YUMI creates a bootleader on the USB drive and them boots the Windows PE ISO, I was thinking that there might be some way to encrypt the whole ISO and then automatically decrypt it before YUMI boots it. Although this seems like too much effort. I was also thinking that maybe the script could be zipped (using 7 zip) within the ISO and then have a a script run on the Windows PE boot that will ask for a password to extract it so it can then be run.

Any help/ideas will be appreciated.

share|improve this question
Welcome Jakub, but this forum is for programming questions only. It's unlikely that you will find many people that know YUMI or likewise. –  Maarten Bodewes - owlstead Jul 10 '12 at 23:12
OK, thanks for the reply anyway. I have ended up ditching this idea for the time being and simplifying it by using the instructions from TechNet –  Jakub Jul 13 '12 at 19:26

1 Answer 1

I'm facing a similar problem, although I don't need YUMI to solve it. Yes, this may be coming a little late, but here we go (this is what I've got so far):

  1. First you need the USB Drive.
  2. Format it NTFS using Windows 7 (Or HP Format Tool).
  3. Access the NTFS USB with a Linux Box (YUMI + Puppy Linux will do), open GParted and turn on the USB NTFS boot flag.
  4. Now the USB is bootable (but doesn't boot yet)
  5. Create a BartPe (http://www.nu2.nu/pebuilder/) folder (no iso) with pebuilder. (You will need a Windows XP SP3 Installation CD/DVD)
  6. Add WinXPE Plugin. There is a little help file, you need to remove some other default plugins for it to work alright (remove: A43 File Management, Startup Group, Nu2Shell) You can configure WinXPE to have password protection
  7. Add TrueCrypt Plugin (http://www.paraglidernc.com/plugins/plugins.htm) Add TrueCrypt files (http://www.truecrypt.org/downloads)
  8. Create the BartPe compilation folder with no iso option, just the files (takes some minutes).
  9. Download Microsoft Windows Server 2003 Service Pack 1 (32 bit)
  10. Unpack WindowsServer2003-KB889101-SP1-x86-ENU.exe (Winrar will do) and extract two files setupldr.bin and ramdisk.sy_
  11. Expand ramdisk.sy_ , and at the CMD run:

    expand ramdisk.sy_ ramdisk.sys

  12. Go to your pebuilder folder (Usually C:\pebuilder3110a) and create a subfolder named "srsp1" with no quotes.
  13. Copy setupldr.bin and ramdisk.sys to C:\pebuilder3110a\srsp1
  14. Now assuming your USB got drive lettter H, in a CMD run:

    cd C:\pebuilder3110a
    pe2usb h:

The last step will take a minute or so. At this point you have a bootable NTFS USB Drive in Windows XP PE with password protection.

Once you boot, start TrueCrypt and create a Encrypted Volume Drive that uses all the remaining free space on your USB Drive. You can put your valuable data on this TrueCrypt volume.

However, I hope at some point to be able to encrypt the whole USB drive and make it booteable. At this time, I can't achieve this with TrueCrypt because the BartPE starts as readonly media.

There is an alternative to pe2usb (http://www.911cd.net/forums//index.php?showtopic=13784) that manages to boot without the ISO mode, yet TrueCrypt is unable to encrypt the USB Drive, but it replaces the win common bootloader with TrueCrypt bootloader.

share|improve this answer
Thanks for the lengthy reply. Unfortunately I have simply created an image which has no passwords hard coded into it so there is no longer need for encryption, although your solution would probably work. –  Jakub Jan 25 '13 at 16:31

Your Answer


