BitLocker Drive Encryption

Microsoft's full-volume disk encryption feature that protects data by providing encryption for entire volumes

What is BitLocker?

BitLocker Drive Encryption is a data protection feature that integrates with the Windows operating system to address threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers.

BitLocker provides the most protection when used with a Trusted Platform Module (TPM) version 1.2 or later. The TPM is a hardware component installed in many newer computers by the manufacturer.

Key Point: BitLocker encrypts the entire volume, not just individual files. This provides comprehensive protection against unauthorized access to your data.

BitLocker Protection Methods

1. TPM-Only Protection

Uses the TPM chip to store encryption keys
Transparent to the user - no additional authentication required
Protects against offline attacks but not unauthorized use of powered-on computer

2. TPM + PIN

Requires user to enter a PIN during boot process
Provides additional security layer
Recommended for laptops and mobile devices

3. TPM + USB Startup Key

Requires a USB flash drive containing a startup key
Computer won't boot without the USB key
Good for systems that need high security

4. Password/Passphrase Only

For systems without TPM chips
Requires strong password/passphrase
Less secure than TPM-based methods

BitLocker To Go (USB/External Drives)

BitLocker To Go extends BitLocker data protection to removable drives such as USB flash drives and external hard drives.

Key Features:

Password Protection: Encrypted drives require password to access
Cross-Platform Reading: Encrypted drives can be read on other Windows systems
Auto-unlock: Can be configured to unlock automatically on trusted computers
Recovery Key: 48-character recovery key for password recovery

Important: BitLocker To Go encrypted drives can be read on Windows 7 and later, but require BitLocker To Go Reader for earlier Windows versions.

BitLocker Requirements

System Requirements:

Windows 10/11 Pro, Enterprise, or Education
TPM 1.2 or later (recommended)
UEFI-based system with Secure Boot
At least 2 disk partitions

For BitLocker To Go:

Windows 10/11 Pro, Enterprise, or Education
USB flash drive or external hard drive
Administrative privileges
Sufficient free space on drive

BitLocker Command Line (manage-bde)

BitLocker can be managed through the command line using the manage-bde command:

Common Commands:

# Check BitLocker status
manage-bde -status

# Enable BitLocker on C: drive
manage-bde -on C: -recoverypassword

# Enable BitLocker on USB drive E:
manage-bde -on E: -password

# Unlock a drive
manage-bde -unlock E: -password

# Lock a drive
manage-bde -lock E:

# Show recovery key
manage-bde -protectors C: -get

Benefits of BitLocker

Full-disk encryption
Built into Windows
Hardware-based security (TPM)
Transparent to users
Group Policy support
USB/removable drive support

Limitations

Windows Pro/Enterprise only
Performance overhead
Recovery key management needed
No protection when system running

Security Best Practices

Always back up recovery keys
Use strong passwords/PINs
Enable TPM + PIN for laptops
Regular recovery key testing
Secure boot configuration

Hands-On Practice

Ready to practice BitLocker encryption?

BitLocker USB Lab

Learn how to encrypt a USB drive with BitLocker To Go

Learning Objectives

After studying this material, you should be able to:

Understand what BitLocker is and how it works
Identify different BitLocker protection methods
Explain BitLocker To Go for removable drives
Use manage-bde command-line tool
Implement BitLocker security best practices