Enabling BitLocker on Removable Drives (USB Flash drives, USB Hard Drives)
There is a way to encrypt removable drives. Prior to attempting to enable BitLocker on your removable drive you need to ensure that the drive is formatted using the NTFS file system and you have backed up the data inside in case things go wrong and you cannot unlock your drive.
This link provides a high level overview of BitLocker: https://en.wikipedia.org/wiki/BitLocker_Drive_Encryption
Here is the executive version for the non-techie people: https://technet.microsoft.com/en-us/windowsvista/aa906018.aspx
Here is a reference to BitLocker FAQ: https://technet2.microsoft.com/WindowsVista/en/library/58358421-a7f5-4c97-ab41-2bcc61a58a701033.mspx?mfr=true
And if you’re really geeky and want to learn more about what encryption algorithm is used and why.. https://download.microsoft.com/download/0/2/3/0238acaf-d3bf-4a6d-b3d6-0a0be4bbb36e/BitLockerCipher200608.pdf
Notes:
BitLocker is only available on Windows Vista Ultimate and Enterprise.
You can use BitLocker even if TPM is not present in your computer.
Before you begin
Before you start to encrypt your removable drive, you will need to think where you will store the key that will be used to unlock the drive. If you loose this key you will loose access to the data in the drive. To know where you want to store the key you need to know how badly do you want to protect the data inside.
Personally, I wanted a level of security over my data so that if I loose my USB drive someone can't just plug it into a computer and get access to the data. I am willing to sacrifice a little bit of security for the purpose of convenience. So I have actually decided to store the keys in 2 places, one is on my laptop hard drive, the other is on my home computer hard drive and I also have a backup key in another USB drive. This is so I can easily gain access to my USB key data on both computers and at the same time, I can also get access to the USB data on another computer by having the key on another USB drive. I have also chosen the default 128 bit AES key because I think this is adequate for my purpose.
To run the utility you will need to do:
Open command prompt using "Run as Administrator". Quickest way to do this is by right clicking the command prompt icon.
Make sure you are in %WINDIR%\System32 directory
Type the following command, this will list out the available parameters. I have also dumped out the parameters below:
cscript manage-bde.wsf
To encrypt the removable drive:
Assumptions:
- Your removable drive has been assigned the drive letter R:
- I want to have a recovery password automatically generated for me
- I want to put my recovery key on D:\
Command to type:
cscript manage-bde.wsf -on R: -recoverykey d:\ -recoverypassword
This will encrypt the removable drive and put the key file in your d:\.
After the encryption, you will see your recovery password generated. Make sure you make a copy of this. It should be in a format similar to this: 111950-074411-044704-271238-313841-511626-093401-026598
To see the key file you will need to make sure in windows explorer you set the option to be able to view hidden and operating system files. The file will look something like: E181C91B-20A9-4702-87C9-33F901D38DE9.BEK
Note that it may take some time for the encryption process to complete. You can check the progress by typing the command below:
cscript manage-bde.wsf -status R:
To access your BitLocked drive:
When you load your removable drive, you an manually type the following (if you want to use your password) - (please use your specific password)
cscript manage-bde.wsf -unlock R: -recoverypassword 111950-074411-044704-271238-313841-511626-093401-026598
Or you can type the following command (Please use your specific key file)
cscript manage-bde.wsf -unlock R: -recoverykey D:\E181C91B-20A9-4702-87C9-33F901D38DE9.BEK
If you want to make life easier for yourself, you can create a batch file with the command above in it.
WARNING: Again before I get flame mails, by keeping your key file in your computer and if you type in your password in the batch file you are reducing the security of your encrypted drive because if someone has access to your computer and your removable drive, they can potential decrypt it.
Parameter Reference (just the relevant ones)
The table below provides a list of the parent parameters and the sub-parameters for each (where applicable)
Parent level syntax:
manage-bde[.wsf] -parameter [arguments]
Parameter
Description
-status
Provides information about BitLocker-capable volumes.
-on
Encrypts the volume and turns BitLocker protection on. Note that this process continues even after the script finishes executing in the command prompt. Use the -status flag to check encryption progress.
-off
Decrypts the volume and turns BitLocker protection off. Note that this process continues even after the script finishes executing in the command prompt. Use the -status flag to check decryption progress.
-pause
Pauses encryption or decryption.
-resume
Resumes encryption or decryption.
-lock
Prevents access to BitLocker-encrypted data.
-unlock
Allows access to BitLocker-encrypted data.
-autounlock
Manages automatic unlocking of data volumes.
You can enable the autounlock option for an encrypted volume if the following conditions are true:
•
The encrypted volume is unlocked when you enable the autounlock option. If the volume is locked, unlock the volume, enable the autounlock option, and then lock the volume again.
•
The operating system volume is encrypted. If you have not encrypted the operating system volume, you receive the following error message when you enable the autounlock option for an encrypted volume:
An error occurred while enabling the volume for auto-unlocking. (code 0x80310020)
-protectors
Manages protection methods for the encryption key. This parameter allows you to add, remove, enable, disable your keys or password to the encrypted drive.
-tpm
Configures the computer's Trusted Platform Module (TPM).
-ForceRecovery
Forces a BitLocker-protected OS to recover on restarts.
-fr
Same as -ForceRecovery
-ComputerName
Runs on another computer. Examples: "ComputerX", "127.0.0.1"
-cn
Same as -ComputerName
-? Or /?
Displays brief help. Example: "-ParameterSet -?"
-Help or -h
Displays complete help. Example: "-ParameterSet -h"
-status
manage-bde -status [Volume] [{-ProtectionAsErrorLevel|-p}] [{-ComputerName|-cn} ComputerName] [{-?|/?}] [{-Help|-h}]
Parameter
Description
Volume
A drive letter followed by a colon. Example: "C:"
-ProtectionAsErrorLevel
-p
Used in developing batch files.
Examples:
manage-bde -status
manage-bde -status e:
manage-bde -status e: -ProtectionAsErrorLevel
-on
manage-bde -on Volume
[{-RecoveryPassword|-rp} [NumericalPassword] ]
[{-RecoveryKey|-rk} PathToExternalKeyDirectory]
[{-StartupKey|-sk} PathToExternalKeyDirectory]
[{-TPMAndPIN|-tp} PIN]
[{-TPMAndStartupKey|-tsk} PathToExternalKeyDirectory]
[{-EncryptionMethod|-em}
{aes128_diffuser|
aes256_diffuser|
aes128|
aes256}]
[{-ComputerName|-cn} ComputerName]
[{-?|/?}] [{-Help|-h}]
Parameter
Description
Volume
A drive letter followed by a colon. Example: "C:"
-RecoveryPassword
- rp
Adds a Numerical Password protector. If this option is used without additional values, the system will generate a random password. If you want to specify your own pass key, you will need to follow the rule below:
The password must contain exactly 48 digits, which can be divided into 8
groups of 6 digits each. Use a hyphen (-) to separate groups of 6 digits on
the command line.
Each group of 6 digits in the 48-digit numerical password must be:
1. Divisible by 11
2. Less than 720896
For example, "000000" is a valid group of 6 digits.
Invalid groups include "123456", "720896", and "888888".
-RecoveryKey
-rk
Adds an External Key protector for recovery.
-StartupKey
-sk
Adds an External Key protector for startup.
-TPMAndPIN
-tp
Adds a TPM And PIN protector for the OS volume.
-TPMAndStartupKey
-tsk
Adds a TPM And Startup Key protector for the OS volume.
-EncryptionMethod
-em
Configures the encryption algorithm and key size. Default is set to AES 128 with Diffuser. If you want to know more about the encryption algorithms you can read it here: https://download.microsoft.com/download/0/2/3/0238acaf-d3bf-4a6d-b3d6-0a0be4bbb36e/BitLockerCipher200608.pdf
-SkipHardwareTest
-s
Begins encryption without a hardware test.
Examples:
manage-bde -on C: -RecoveryPassword
manage-bde -on C: -RecoveryKey e:\ -RecoveryPassword
manage-bde -on C: -rp -rk "f:\Folder" -SkipHardwareTest
-off
manage-bde -off Volume [{-ComputerName|-cn} ComputerName] [{-?|/?}] [{-Help|-h}]
Parameter
Description
Volume
A drive letter followed by a colon. Example: "C:"
-unlock
manage-bde -unlock Volume
{[{-RecoveryPassword| -rp} NumericalPassword] |
[{-RecoveryKey|-rk} PathToExternalKeyFile]}
[{-ComputerName|-cn} ComputerName]
[{-?|/?}] [{-Help|-h}]
Parameter
Description
Volume
A drive letter followed by a colon. Example: "C:"
-RecoveryPassword
- rp
Provide a password to unlock the volume.
-RecoveryKey
-rk
Provide an external key file to unlock the volume.
Examples:
manage-bde -unlock -?
manage-bde -unlock e: -RecoveryPassword ...
manage-bde -unlock e: -RecoveryKey "f:\File Folder\Filename"
-autounlock
manage-bde -autounlock Volume
[-enable | -disable | -ClearAllKeys] volume
[{-ComputerName|-cn} ComputerName]
[{-?|/?}] [{-Help|-h}]
Parameter
Description
Volume
A drive letter followed by a colon. Example: "C:"
-enable
Enables automatic unlocking for a data volume.
-disable
Disables automatic unlocking for a data volume.
-ClearAllKeys
Removes all stored external keys on the OS volume.
Examples:
managee-bde -autounlock -enable E:
managee-bde -autounlock -disable E:
managee-bde -autounlock -ClearAllKeys C:
-protectors
manage-bde -protectors
manage-bde -protectors -get Volume -parameter [arguments]
manage-bde -protectors -add Volume -parameter [arguments]
manage-bde -protectors -delete Volume -parameter [arguments]
manage-bde -protectors -disable Volume
manage-bde -protectors -enable Volume
Parameter
Description
Volume
A drive letter followed by a colon. Example: "C:"
-get
Displays key protection methods. Include '-?' for parameters.
-add
Adds key protection methods. Include '-?' for parameters.
The options in here is the same as when you use the -on option.
-delete
Deletes key protection methods. Include '-?' for parameters.
-disable
Disables protection. Allows anyone to access encrypted data by making the encryption key available unsecured on disk. No key protectors are removed.
-enable
Enables protection by removing the unsecured encryption key from disk. All key protectors take into effect.