Windows 8 : Security - BitLocker Drive Encryption

BitLocker Drive Encryption is a feature that encrypts a logical volume so the data on disk can’t be read by outside parties. If your laptop is lost or stolen, BitLocker protects your data from being accessed by others. A logical volume is a disk partition or set of partitions and can be part of a disk or can even be combinations of partitions that span one or more disks. With BitLocker, the boot partition remains unencrypted.

BitLocker appeared in Microsoft Vista and has been carried over with some improvements into Windows 8 Pro and Windows 8 Enterprise; it is not available on Windows 8 and Windows 8 RT. The notable improvements are:

• User password and PIN selection. Users can now set their passwords and PINs without having administrative privileges.

• Used disk space encryption. The latest version of BitLocker encrypts the whole volume.

• Pre-provisioning. You can encrypt a hard drive and install Windows 8 on it.

You should use pre-provisioning only on a new, fully encrypted hard drive. If you pre-provision an already used drive, only the used parts of the drive will be encrypted. Any unused parts of any volume will contain unencrypted data that can be read. That is, any files you may have created (and perhaps even deleted) will still be on your drive in an unencrypted form and can be read by others.

• Hardware hard drive encryption. BitLocker can recognize whether a hard drive is encrypted and will use the drive’s hardware instead of the CPU to read and write data.

Files you add to your encrypted drive will be encrypted. If you copy those files to an unencrypted drive, they will be unencrypted on that drive.

Encrypted File System (EFS) allows you to encrypt sensitive files on your computer without using BitLocker to encrypt the drive. EFS is described in the next section.

To use BitLocker to encrypt a volume

1. Press +W and type bitlocker. Tap or click the BitLocker button to display the BitLocker Drive Encryption control panel .

 The BitLocker control panel

You can also open BitLocker from the System and Security section of the Control Panel.

2. Click the Turn on BitLocker link for the volume you wish to encrypt to launch the BitLocker wizard.

3. In the Choose How You Want to Unlock This Drive screen , enable either the password or smart card option to create the access key; type the password twice, and press Enter.

 Step 1 of the BitLocker wizard

4. In the How Do You Want To Back Up Your Recovery Key screen (step 2 of the wizard) , click a location.

 Step 2 of the BitLocker wizard

You can choose more than one location, which is a good idea. The backup key is required in case you can’t access your drive. Placing the key on the same drive that is encrypted means that you may lose access to that copy of the key. That’s why a backup somewhere else is essential. The Save To Your Microsoft Account option saves the backup key to the cloud. If you click Save To A File, you will be prompted to pick a location to save the recovery key file to ; if you choose a local drive, you will see an alert box  that informs you that it is more secure to save the file to another PC or device.

 Pick a location to save the recovery key file to. If you save the key to your USB drive or SkyDrive, you can access it should you lose the local copy.

 This alert box tells you to save the recovery key to another PC or device.

5. In the “Choose how much of your drive to encrypt” screen (step 3 of the wizard) , choose to encrypt either the used disk space or the entire drive. Click Next.

 Encrypt either the used disk space or the entire volume.

6. In the final step of the wizard , click the Start Encrypting button.

 The final step of the wizard

Windows 8 displays a notice indicating that the drive is being encrypted .

 Drive encryption is in progress.

Tip

If you tap or click the Manage BitLocker link in the System and Security section of the Control Panel, you can back up the recovery key, change or remove your password, add a smart card, turn on auto-unlock, or turn BitLocker off for your encrypted drive.