Section 5: BitLocker

The Big Picture: What If Someone Steals the Laptop?

A Windows password stops people from signing in. But it does not stop a thief from taking out the SSD, plugging it into another computer, and reading every file directly. Windows is not running on that other computer, so Windows' permissions do not apply.

The only real answer is to make the data on the disk unreadable without a key. That is encryption. Microsoft's built-in tool for it is BitLocker.

5.1 Full Disk Encryption Concept

What it is: Full-volume encryption (often "full disk encryption") means every sector of a drive volume is stored scrambled. Files, the page file, temporary files, hibernation data: all of it. A volume is a drive or partition, like C:.

The key point: Encryption happens in the storage driver, below the file system. Programs read and write normally. Windows decrypts on the way in and encrypts on the way out, in small blocks. You do not see it, and with modern CPUs the slowdown is usually small (many have special AES instructions).

   App / Explorer            sees normal files
        │
   ┌────▼────────────────┐
   │ File system (NTFS)  │   sees normal files
   └────┬────────────────┘
   ┌────▼────────────────┐
   │ BitLocker driver    │   encrypts on write, decrypts on read
   └────┬────────────────┘
   ┌────▼────────────────┐
   │ Disk (SSD / HDD)    │   holds only scrambled data
   └─────────────────────┘

The cipher. BitLocker uses AES (Advanced Encryption Standard), a well-trusted scrambling method. The key size and mode depend on the version and settings: typically AES-128 or AES-256, in a mode called XTS (made for disk sectors) on current Windows. Older versions used CBC mode. Treat the exact default as "depends on your Windows version and policy".

What BitLocker protects, and what it does not:

Editions and availability (depends on edition and hardware):

Windows tip: In Settings → Privacy & security → Device encryption (if present) or BitLocker drive encryption in Control Panel you can see the state. If you do not see either, your edition or hardware may not support it.

5.2 Key Protectors (TPM, PIN, Recovery Key)

Why not use one password as the key? Because a password is weak and users forget it. BitLocker uses a key hierarchy (layers of keys):

• FVEK (Full Volume Encryption Key): the key that actually scrambles the disk data.
• VMK (Volume Master Key): a key that locks the FVEK.
• Key protectors: one or more ways to unlock the VMK.

The data never needs to be re-encrypted when you change a PIN or add a recovery key. Only the small protector locking the VMK changes.

 ┌─────────────────────────────────────────────┐
 │ Disk data (scrambled sectors)               │
 └─────────────────────────▲───────────────────┘
                           │ decrypted by
 ┌─────────────────────────┴───────────────────┐
 │ FVEK  Full Volume Encryption Key            │
 └─────────────────────────▲───────────────────┘
                           │ unlocked by
 ┌─────────────────────────┴───────────────────┐
 │ VMK   Volume Master Key                     │
 └──▲──────────▲───────────▲──────────▲────────┘
    │          │           │          │
 ┌──┴───┐  ┌───┴──┐  ┌─────┴────┐  ┌──┴───────┐
 │ TPM  │  │ PIN  │  │ Recovery │  │ Startup  │
 │      │  │      │  │ password │  │ USB key  │
 └──────┘  └──────┘  └──────────┘  └──────────┘
      any ONE valid protector unlocks the VMK

The common protectors:

The recovery key is the most important thing to understand. If BitLocker ever refuses to unlock, the recovery password is the only way back in. No one, including Microsoft, can crack it for you. Microsoft only stores it if you chose to save it to your account or organisation.

BACK UP THE RECOVERY KEY. Save it in at least two safe places (your Microsoft account, a printout in a safe place, or a file on a different device). Do not store it only on the same encrypted disk. Without it, a locked disk means lost data.

When does BitLocker ask for the recovery key? When the TPM's measurements do not match what was sealed. Common reasons:

Handy commands (run as administrator):

manage-bde -status                 # shows each volume: encrypted? protectors?
Get-BitLockerVolume                # the PowerShell version
manage-bde -protectors -get C:     # lists protectors (including the recovery ID)

Safe-use rule: Before you update firmware, change Secure Boot, or clear the TPM, suspend BitLocker for one reboot (Windows Security or Suspend-BitLocker), then it resumes. Do this only if you know why; you can also just have the recovery key ready.

5.3 Encryption/Decryption Flow During Boot

Here is what happens when you press the power button on a PC with TPM-only BitLocker.

 1. Power on
    │
 2. UEFI starts; Secure Boot checks the boot manager
    │      (PCRs record firmware and boot measurements)
    ▼
 3. Boot manager runs from the small unencrypted
    system partition; the Windows volume is still LOCKED
    │
 4. Boot manager asks the TPM:
    │      "Release the VMK?"
    ▼
 5. TPM compares the PCRs with the sealed values
    │
    ├── MATCH ─────► TPM releases the key (or asks for PIN first)
    │                 VMK unlocks FVEK, volume decrypts on the fly
    │                 Windows loads normally
    │
    └── NO MATCH ──► Key stays locked
                     BitLocker recovery screen asks for the
                     48-digit recovery password

Key facts about the flow:

• A small system partition (unencrypted) must hold the boot manager, because the firmware cannot read an encrypted volume. It holds no secrets.
• The key is released before the OS runs, so a stolen drive without the TPM cannot decrypt itself.
• Once the volume is unlocked, the FVEK sits in memory. Encryption and decryption happen per sector in the driver. This is why a running, signed-in PC is not protected by BitLocker against malware.
• In TPM-only mode, the PC boots straight into the Windows sign-in screen. The sign-in password is then the only guard against someone who has the whole powered-off PC. TPM + PIN adds one more guard before Windows loads.

Encrypting an existing disk. When you turn BitLocker on, Windows encrypts the used space in the background (you can keep working). Large disks can take a while. On a new drive, you can choose to encrypt only used space, which is much faster.

Hardware-encrypted drives. Some SSDs encrypt on their own (self-encrypting drives). BitLocker can use this ("hardware encryption") but Microsoft's default now prefers software encryption, because hardware implementations in some drives were found to be weak. Depends on your drive and policy.

Summary