EMZETT.
Login

Emzett Wiki

BitLocker

Properties1
tagssicherheit, windows, verschlüsselung

2 min read

BitLocker

In short: BitLocker is Windows’ drive encryption. It encrypts a whole partition or disk so that without the right key the data is only random values, even if the drive is removed.

In more detail: A Windows login password does not protect data from someone who starts the computer with another system or plugs the disk into another computer. Then they can simply read the files. BitLocker closes that gap: without the key the data stays unreadable.

In Depth

How it works:

  • Data is encrypted block by block with AES (128 or 256 bit, usually XTS mode). This is transparent to the user and costs hardly any performance on modern hardware.
  • The data key (FVEK, full volume encryption key) is itself encrypted (by the VMK, volume master key).
  • The VMK is protected by one or more protectors: TPM, PIN, USB key, recovery key.
  • TPM binding: The key sits in the TPM chip and is released only if startup is unchanged (firmware, bootloader, Secure Boot state). If the boot chain is manipulated or the disk is put into another computer, the key stays locked.
  • Additional PIN: “TPM + PIN” asks for input before startup. Protects against attackers who have the whole computer.

Recovery key (48 digits): Shown during setup and stored in the Microsoft account. Without it the data is permanently lost after a firmware change, a motherboard swap or an error. Back it up without fail.

Role in protecting a switched-off computer: If a laptop is stolen, the Windows password does not protect the files. BitLocker does, because the thief can neither decrypt the disk nor manipulate the system.

Limits:

  • Does not protect while the computer is running and unlocked (malware, logged-in user, memory attacks).
  • Only Windows Pro, Enterprise and Education (Windows 11 Home has “device encryption” with similar technology).
  • Related: FileVault (macOS), LUKS/dm-crypt (Linux), VeraCrypt.
  • Typical errors: “BitLocker recovery” appears after BIOS updates or changed boot options. Keep the key ready and afterwards suspend/resume protection.

See also: TPM and TPM 2.0, Secure Boot, Bypassing: how login protection is circumvented and how to defend

Backlinks