Enabling BitLocker on Removable Drives (USB Flash drives, USB Hard Drives)

 

  1. There is a way to encrypt removable drives. Prior to attempting to enable BitLocker on your removable drive you need to ensure that the drive is formatted using the NTFS file system and you have backed up the data inside in case things go wrong and you cannot unlock your drive.

  2.  

  3. This link provides a high level overview of BitLocker: https://en.wikipedia.org/wiki/BitLocker_Drive_Encryption

  4.  

  5. Here is the executive version for the non-techie people: https://technet.microsoft.com/en-us/windowsvista/aa906018.aspx

  6.  

  7. Here is a reference to BitLocker FAQ: https://technet2.microsoft.com/WindowsVista/en/library/58358421-a7f5-4c97-ab41-2bcc61a58a701033.mspx?mfr=true

  8.  

  9. And if you’re really geeky and want to learn more about what encryption algorithm is used and why..  https://download.microsoft.com/download/0/2/3/0238acaf-d3bf-4a6d-b3d6-0a0be4bbb36e/BitLockerCipher200608.pdf

  10.  

  11. Notes:

  12.  BitLocker is only available on Windows Vista Ultimate and Enterprise.

  13. You can use BitLocker even if TPM is not present in your computer.

     

    Before you begin

    Before you start to encrypt your removable drive, you will need to think where you will store the key that will be used to unlock the drive.  If you loose this key you will loose access to the data in the drive.  To know where you want to store the key you need to know how badly do you want to protect the data inside.

     

    Personally, I wanted a level of security over my data so that if I loose my USB drive someone can't just plug it into a computer and get access to the data.  I am willing to sacrifice a little bit of security for the purpose of convenience.  So I have actually decided to store the keys in 2 places, one is on my laptop hard drive, the other is on my home computer hard drive and I also have a backup key in another USB drive.  This is so I can easily gain access to my USB key data on both computers and at the same time, I can also get access to the USB data on another computer by having the key on another USB drive.  I have also chosen the default 128 bit AES key because I think this is adequate for my purpose.

     

    To run the utility you will need to do:

  14. Open command prompt using "Run as Administrator". Quickest way to do this is by right clicking the command prompt icon.

  15. Make sure you are in %WINDIR%\System32 directory

  16. Type the following command, this will list out the available parameters. I have also dumped out the parameters below:

    cscript manage-bde.wsf

     

    To encrypt the removable drive:

    Assumptions:

    • Your removable drive has been assigned the drive letter R:
    • I want to have a recovery password automatically generated for me
    • I want to put my recovery key on D:\

     

     

    Command to type:

    cscript manage-bde.wsf -on R: -recoverykey d:\ -recoverypassword

     

    This will encrypt the removable drive and put the key file in your d:\. 

     

    After the encryption, you will see your recovery password generated.  Make sure you make a copy of this.  It should be in a format similar to this:  111950-074411-044704-271238-313841-511626-093401-026598

     

    To see the key file you will need to make sure in windows explorer you set the option to be able to view hidden and operating system files.  The file will look something like:  E181C91B-20A9-4702-87C9-33F901D38DE9.BEK

     

    Note that it may take some time for the encryption process to complete.  You can check the progress by typing the command below:

    cscript manage-bde.wsf -status R:

     

    To access your BitLocked drive:

    When you load your removable drive, you an manually type the following (if you want to use your password) - (please use your specific password)

    cscript manage-bde.wsf -unlock R: -recoverypassword 111950-074411-044704-271238-313841-511626-093401-026598

     

    Or you can type the following command (Please use your specific key file)

    cscript manage-bde.wsf -unlock R: -recoverykey D:\E181C91B-20A9-4702-87C9-33F901D38DE9.BEK

     

    If you want to make life easier for yourself, you can create a batch file with the command above in it. 

     

    WARNING: Again before I get flame mails, by keeping your key file in your computer and if you type in your password in the batch file you are reducing the security of your encrypted drive because if someone has access to your computer and your removable drive, they can potential decrypt it.

     

    Parameter Reference (just the relevant ones)

    The table below provides a list of the parent parameters and the sub-parameters for each (where applicable)

     

    Parent level syntax:

    manage-bde[.wsf] -parameter [arguments]

     

    Parameter

    Description

    -status        

    Provides information about BitLocker-capable volumes.

    -on

    Encrypts the volume and turns BitLocker protection on.  Note that this process continues even after the script finishes executing in the command prompt.  Use the -status flag to check encryption progress.

    -off

    Decrypts the volume and turns BitLocker protection off. Note that this process continues even after the script finishes executing in the command prompt.  Use the -status flag to check decryption progress.

    -pause

    Pauses encryption or decryption.

    -resume

    Resumes encryption or decryption.

    -lock

    Prevents access to BitLocker-encrypted data.

    -unlock

    Allows access to BitLocker-encrypted data.

    -autounlock

    Manages automatic unlocking of data volumes. 

    You can enable the autounlock option for an encrypted volume if the following conditions are true:

    The encrypted volume is unlocked when you enable the autounlock option. If the volume is locked, unlock the volume, enable the autounlock option, and then lock the volume again.

    The operating system volume is encrypted. If you have not encrypted the operating system volume, you receive the following error message when you enable the autounlock option for an encrypted volume:

    An error occurred while enabling the volume for auto-unlocking. (code 0x80310020)

    -protectors

    Manages protection methods for the encryption key.  This parameter allows you to add, remove, enable, disable your keys or password to the encrypted drive.

    -tpm

    Configures the computer's Trusted Platform Module (TPM).

    -ForceRecovery

    Forces a BitLocker-protected OS to recover on restarts.

    -fr

    Same as -ForceRecovery

    -ComputerName

    Runs on another computer. Examples: "ComputerX", "127.0.0.1"

    -cn

    Same as -ComputerName

    -? Or /?

    Displays brief help. Example: "-ParameterSet -?"

    -Help or -h

    Displays complete help. Example: "-ParameterSet -h"

     

    -status  

    manage-bde -status [Volume]   [{-ProtectionAsErrorLevel|-p}]  [{-ComputerName|-cn} ComputerName]  [{-?|/?}] [{-Help|-h}]

    Parameter

    Description

    Volume

    A drive letter followed by a colon. Example: "C:"

    -ProtectionAsErrorLevel

    -p

    Used in developing batch files.

    Examples:

        manage-bde -status

        manage-bde -status e:

        manage-bde -status e: -ProtectionAsErrorLevel

     

    -on

    manage-bde -on Volume

            [{-RecoveryPassword|-rp} [NumericalPassword] ]

            [{-RecoveryKey|-rk} PathToExternalKeyDirectory]

            [{-StartupKey|-sk} PathToExternalKeyDirectory]

            [{-TPMAndPIN|-tp} PIN]

            [{-TPMAndStartupKey|-tsk} PathToExternalKeyDirectory]

            [{-EncryptionMethod|-em}

                {aes128_diffuser|

                 aes256_diffuser|

                 aes128|

                 aes256}]

            [{-ComputerName|-cn} ComputerName]

            [{-?|/?}] [{-Help|-h}]

     

    Parameter

    Description

    Volume

    A drive letter followed by a colon. Example: "C:"

    -RecoveryPassword

    - rp

    Adds a Numerical Password protector.  If this option is used without additional values, the system will generate a random password.  If you want to specify your own pass key, you will need to follow the rule below:

     

    The password must contain exactly 48 digits, which can be divided into 8

    groups of 6 digits each. Use a hyphen (-) to separate groups of 6 digits on

    the command line.

    Each group of 6 digits in the 48-digit numerical password must be:

    1. Divisible by 11

    2. Less than 720896

     

    For example, "000000" is a valid group of 6 digits.

    Invalid groups include "123456", "720896", and "888888".

     

    -RecoveryKey

    -rk

    Adds an External Key protector for recovery.

    -StartupKey

    -sk

    Adds an External Key protector for startup.

    -TPMAndPIN

    -tp

    Adds a TPM And PIN protector for the OS volume.

    -TPMAndStartupKey

    -tsk

    Adds a TPM And Startup Key protector for the OS volume.

    -EncryptionMethod

    -em

    Configures the encryption algorithm and key size.  Default is  set to AES 128 with Diffuser.  If you want to know more about the encryption algorithms you can read it here: https://download.microsoft.com/download/0/2/3/0238acaf-d3bf-4a6d-b3d6-0a0be4bbb36e/BitLockerCipher200608.pdf

    -SkipHardwareTest

    -s

    Begins encryption without a hardware test.

    Examples:

        manage-bde -on C: -RecoveryPassword

        manage-bde -on C: -RecoveryKey e:\ -RecoveryPassword

        manage-bde -on C: -rp -rk "f:\Folder" -SkipHardwareTest

     

    -off

    manage-bde -off Volume  [{-ComputerName|-cn} ComputerName]  [{-?|/?}] [{-Help|-h}]

     

    Parameter

    Description

    Volume

    A drive letter followed by a colon. Example: "C:"

     

    -unlock

    manage-bde -unlock Volume

                        {[{-RecoveryPassword| -rp} NumericalPassword] |

                        [{-RecoveryKey|-rk} PathToExternalKeyFile]}

                        [{-ComputerName|-cn} ComputerName]

                        [{-?|/?}] [{-Help|-h}]

     

    Parameter

    Description

    Volume

    A drive letter followed by a colon. Example: "C:"

    -RecoveryPassword

    - rp

    Provide a password to unlock the volume.

    -RecoveryKey

    -rk

    Provide an external key file to unlock the volume.

    Examples:

        manage-bde -unlock -?

        manage-bde -unlock e: -RecoveryPassword ...

        manage-bde -unlock e: -RecoveryKey "f:\File Folder\Filename"

     

    -autounlock

    manage-bde -autounlock  Volume

                        [-enable | -disable | -ClearAllKeys] volume

                        [{-ComputerName|-cn} ComputerName]

                        [{-?|/?}] [{-Help|-h}]

     

    Parameter

    Description

    Volume

    A drive letter followed by a colon. Example: "C:"

    -enable

    Enables automatic unlocking for a data volume.

    -disable

     

    Disables automatic unlocking for a data volume.

    -ClearAllKeys

    Removes all stored external keys on the OS volume.

    Examples:

        managee-bde -autounlock -enable E:

        managee-bde -autounlock -disable E:

        managee-bde -autounlock -ClearAllKeys C:

     

    -protectors

    manage-bde -protectors

     

    manage-bde -protectors -get Volume -parameter [arguments]

     

    manage-bde -protectors -add Volume -parameter [arguments]

     

    manage-bde -protectors -delete Volume -parameter [arguments]

     

    manage-bde -protectors -disable Volume

     

    manage-bde -protectors -enable Volume

     

    Parameter

    Description

    Volume

    A drive letter followed by a colon. Example: "C:"

    -get

    Displays key protection methods.  Include '-?' for parameters.

    -add

    Adds key protection methods. Include '-?' for parameters.

    The options in here is the same as when you use the -on option.

    -delete

    Deletes key protection methods. Include '-?' for parameters.

    -disable

    Disables protection. Allows anyone to access encrypted data by making the encryption key available unsecured on disk. No key protectors are removed.

    -enable

    Enables protection by removing the unsecured encryption key from disk. All key protectors take into effect.