Why I no longer avoid BitLocker.
Hi, everyone. Leo Notenboom here for
Askleo.com. Bitlocker is Microsoft's
embedded encryption technology in Windows from Windows Vista on.
I believe it's available in one form or
another in every edition of Windows, other than home.
And even there,
I suspect it's been sneaking in in later editions just without the level of control
that Pro and enterprise and so forth give you.
I used to avoid it because it
used to be very easy to, what I call, encrypt yourself into a corner.
In other words,
find yourself with your data so securely encrypted that even you can't get to it.
That's not particularly useful.
However, Microsoft has done some things to BitLocker over the years that make it
significantly harder for you to encrypt yourself into a corner
as long as you take some certain steps along the way.
And what I want to do is walk through what
those steps are so that you can use BitLocker safely.
So we're going to start by encrypting my drive with BitLocker.
We're over here in Windows 11.
I'm firing up Windows File Explorer and I'll right click on my local disk C.
Actually, let me just click on the local
disk C first so you can see that this is my system drive.
If I right click on it, I now have the option to turn on BitLocker.
I will click on that and then it's going
to make sure that my system is BitLocker capable.
There are some requirements, I think, probably with Windows 11.
It's one of the things that would require TPM.
I'm not sure.
But the bottom line is that it's doing some checks first to make sure you can.
If you can't, hopefully it'll tell you why.
In my case, I can.
Next, and this is what is so incredibly important.
How do you want to back up your recovery key?
You want to back up your recovery key.
Trust me on this.
This is what will save your bacon should there ever be a problem.
I'll explain why that is in a moment, but I want you to do this.
I'm going to save it to a file.
You can see I've already done this once.
I'll do it again.
Yes, do I want to replace it? Sure.
No, okay, fine.
I'm just going to give it another name.
There.
Now I have saved the recovery key
to a different drive, to a drive that is not being encrypted.
In my case, it was my Faux USB.
Ideally, it would be a USB drive of yours or something.
Save that recovery key in a safe location.
Put it somewhere where a month from now,
a year from now, two years from now, you can find it, because it's what will
get you back into your drive in a scenario where there's a problem.
Now that we've saved it one way or another, and indeed,
saving it to your Microsoft account is another good way if you are signed
in to a Microsoft account while you're doing this.
I like doing both.
Letting it saved in my Microsoft account
is great, but having my own copy protects me even from losing that account.
Having saved it one way or another, I'm going to hit Next.
Encrypt used disk space only.
This is honestly up to you.
If you're concerned about someone being able to recover files from the unused
space on the drive, then you want to encrypt the entire thing.
Most of the time encrypting the used disk space is fine.
New Encryption Mode, again, is fine, especially if this is a drive that is not
going to be moved from machine to machine as this is.
It's the internal drive for this machine
and we'll let it do its thing, start encrypting.
Now it's encrypting.
Now if we take a look, if we right click on local disk C,
you could see it's telling me that the BitLocker encryption is in progress.
If we right click on it and say Manage BitLocker,
now you can see that it is still encrypting.
We still have the option here to back up the recovery key.
If for some reason you didn't, do it now.
Back up the recovery key.
However, given that it is continuing to encrypt,
I'm going to refresh this and the encryption is done since it has
switched from BitLocker Encrypting to BitLocker On, great, it's there.
Now, the scenario that I think a lot
of people find surprising, and I strongly recommend you do,
what I'm about to suggest, is that some people are finding
that BitLocker has been turned on on their machine without their knowledge.
Usually it's on new machines that come with BitLocker enabled by default.
That's fine, but you still need that recovery key.
Right click on your drive, in this case my C drive,
click on Manage BitLocker, and here you'll see whether or not BitLocker is on.
If it's off, you can decide whether or not you want to turn it on.
It's up to you.
If it's on and you didn't turn it on, or you've never saved the recovery key,
click on back up your recovery key now and save that recovery key somehow.
That is what will prevent you from encrypting yourself into a corner.
So what do I mean when I keep saying that, encrypting yourself into a corner?
Well, the scenario is an odd one that I
think a lot of people don't quite understand.
That's simply this.
Your encryption of this drive is not tied to your login credentials.
It's tied to your login profile.
It's stored in your profile,
so you need to log in in order for the drive to appear in unencrypted form.
But if for some reason your machine crashes
or your profile becomes corrupt, which happens from time to time.
If you can't log in to the machine for any
reason, you can't access the encrypted data.
It's the point of the encryption, right?
You don't want somebody to just be able
to walk up to your machine and access the encrypted data.
They need to be able to sign in as you.
If you can't sign in because the machine's
broken, because the profile's corrupt, because you've forgotten your password,
because your account got hacked, any number of different reasons,
then you too are prevented from accessing your encrypted information.
That is when the backup recovery key becomes important.
What ends up happening is that you create a new user account.
By the way, creating a new user account with the exact
same username and password on this machine or on any machine is not enough.
That's why I say it is not associated with your user account.
It is stored with your user account,
but it is not associated with your user account.
So it's not enough
to basically create a new account with the same username and password.
What you end up doing is
on another machine or with another user account, you attempt to recover the drive.
When you do so, you will be asked for the backup of your recovery key.
Your ability to provide that
is what will regain you access to the encrypted contents of the drive.
That's why it is so important
that you keep that recovery key and that you keep it somewhere safe
so that it'll be there when, not if, when you end up needing it.
Now, there is, of course, one other thing you can do to protect yourself.
And honestly, if you do it well enough, you can get by without the recovery key.
I still don't recommend it.
And that is back up.
Back up the contents of the encrypted drive in its unencrypted format.
That could mean using an image backup program.
You'll need to understand whether or not your specific image backup programbacks
up the contents unencrypted or the encrypted partition.
If it's the unencrypted data, great.
Store that somewhere else in some other secure manner.
Regardless of how you're backing up
the contents of that drive, my recommendation is you back it up
in unencrypted form and then secure it some other way, be it physically,
by putting it in a closet, by encrypting it,
using some other technology, creating a big zip file out of it, whatever.
Bottom line is that you've got everything
on that drive and you're backing it up regularly.
Honestly, you should be backing it up
regularly anyway because it is another way that you can restore your data should you
ever lose the encryption or the encryption key.
However, my true recommendation is, of course, to do both.
Make sure that you have saved your backup
recovery key and that you're backing up the data regularly.
Now, I do have to close this by pointing out
that there are a couple of good alternatives to BitLocker that are also
useful and that aren't quite as, I'll just call it complicated as BitL ocker.
Bitl ocker, like I said, it's tied into Windows.
It's tied into your user account.
It is not part of your user account, but it's stored with your user account.
Tools like Vericrypt or Boxcryptor
are more traditional in the sense that what you need to access those
is a password, technically a passphrase, something longer.
But they are device independent.
They're not associated with any other account.
You can usually port whatever it is that is encrypted to other devices.
For example, you can mount a Vericrypt volume on Windows, on Mac, on Linux.
Ditto for Boxcryptor, Ditto for Cryptometer Encrypted stuff.
Again, perhaps more flexible, more portable, but it is additional third
party software that you then need to install.
So I hope that helps you understand and how best to protect yourself.
I do recommend encrypting your hard drive,
especially if it's on a laptop and you're traveling.
Now you know how to do it safely
and now you know how to do it without encrypting yourself into a corner.
For comments, for updates,
for links related to this topic and more, visit
Askleo.com/17437.
I'm Leo Notenboom, and this is
Askleo.com. Thanks for watching.