6. How to Disable or Remove BitLocker Drive Encryption
Because BitLocker intercepts the boot process and looks for
changes to any of the early boot files, it can cause problems in the
following nonattack scenarios:
-
Upgrading or replacing the motherboard or TPM -
Installing a new operating system that changes the master
boot record or the boot manager -
Moving a BitLocker-encrypted disk to another TPM-enabled
computer -
Repartitioning the hard disk -
Updating the BIOS -
Third-party updates that occur outside the operating
system (such as hardware firmware updates)
To avoid entering BitLocker recovery mode, you can disable
BitLocker temporarily, which allows you to change the TPM and
upgrade the operating system. When you re-enable BitLocker, the same
encryption keys will be used. You can also choose to decrypt the
BitLocker-protected volume, which will completely remove BitLocker
protection. You can re-enable BitLocker only by repeating the
process to create new keys and reencrypt the volume.
To disable BitLocker temporarily or decrypt the BitLocker-protected volume
permanently, perform these steps:
-
Log on to the computer as Administrator. -
From Control Panel, open BitLocker Drive
Encryption. -
Click Suspend Protection for the volume that has BitLocker
enabled to use a clear key. To remove BitLocker completely,
click Turn Off BitLocker.
7. Troubleshooting BitLocker Problems
Several common BitLocker problems are actually "features." The problems occur
because BitLocker is designed to provide protection from specific
types of attacks. Often these legitimate uses resemble attacks and
cause BitLocker to refuse to allow the computer to start or the
BitLocker encryption to prevent you from accessing files:
-
The operating system fails to start
in a dual-boot configuration You can dual-boot a
computer after enabling BitLocker. However, the second operating
system instance must be configured on a different partition. You
cannot dual-boot to a second operating system installed on the
same partition. -
The operating system fails to start
if you move the hard disk to a different computer
BitLocker is designed to protect data from offline attacks, such
as attacks that bypass operating system security by connecting
the hard disk to a different computer. The new computer will be
unable to decrypt the data (even if it has a TPM chip in it).
Before moving a BitLocker-encrypted disk to a different
computer, disable BitLocker. Re-enable BitLocker after
transferring the disk. Alternatively, you can use the recovery
key to start Windows after moving the hard disk to the new
computer. -
The data on the hard disk is
unreadable using standard disk recovery tools For the
same reasons stated in the previous bullet point, BitLocker
files are unreadable using standard disk recovery tools. Some
day recovery tools that support decrypting BitLocker files using
a recovery key might be available. As of the time of this
writing, your only opportunity for recovering BitLocker
encrypted files is to start Windows 7 using the BitLocker
recovery key. For this reason it is very important to regularly
back up BitLocker-encrypted volumes.
Practice: Encrypt and Recover Encrypted Data
In this practice, you simulate the recovery of a lost EFS
encryption certificate.
EXERCISE 1 Encrypt
Data
In this exercise, you encrypt a file. Windows 7
automatically generates an EFS key if you don't already have
one.
-
Log on to a computer running Windows 7 as a standard
user. -
Create a file named Encrypted.txt in your Documents
folder. -
Right-click the Encrypted.txt file, and then click
Properties. -
On the General tab of the Properties dialog box, click
Advanced. -
Select the Encrypt Contents To Secure Data check box,
and then click OK twice. -
In the Encryption Warning dialog box, select Encrypt The
File Only, and then click OK.
Notice that Windows Explorer displays the Encrypted.txt
file in green. -
Double-click the Encrypted.txt file to open it in
Microsoft Notepad. Then add the text "This file is encrypted."
Save the file and close Notepad. -
Double-click the file to verify that you can open it,
and then close Notepad again.
Now you have encrypted a file, and no user can access it
without your EFS key.
EXERCISE 2 Back Up an EFS
Key
In Exercise 1, you encrypted a file. In this exercise, you
back up the EFS key that was generated automatically when you
encrypted the file. Then you delete the original key and determine
whether you can access the EFS-encrypted file. To complete this
practice, you must have completed Exercise 1.
-
Click Start, and then click Control Panel. -
Click the User Accounts link twice. -
In the left pane, click the Manage Your File Encryption
Certificates link.
The Encrypting File System Wizard appears. -
On the Manage Your File Encryption Certificates page,
click Next. -
On the Select Or Create A File Encryption Certificate
page, leave the default certificate (your EFS certificate)
selected, and then click Next. -
On the Back Up The Certificate And Key page, click
Browse and select the Documents folder. For the file name,
type EFS-cert-backup.pfx. Click
Save, and then type a complex password in the Password and
Confirm Password fields. Click Next. -
If the Update Your Previously Encrypted Files page
appears, leave all check boxes cleared and then click
Next. -
On the Encrypting File System page, click Close. -
In Windows Explorer, open your Documents folder and
verify that the EFS certificate was exported correctly.
Now that you have backed up your EFS key, you can lose
it safely. Simulate a corrupted or lost key by following these
steps to delete it: -
Click Start, type mmc, and then press Enter to open a
blank MMC. -
Click File, and then click Add/Remove Snap-in. -
Select Certificates and click Add. -
Select My User Account, and then click Finish. -
Click OK. -
Expand Certificates – Current User, expand Personal, and
then select Certificates. -
In the middle pane, right-click your EFS certificate,
and then click Delete. -
In the Certificates dialog box, click Yes to confirm
that you want to delete the certificate. -
Log off the current desktop session and then log back
on. Windows 7 caches the user's EFS certificate. Thus, if you
remained logged on, you would still be able to open your
encrypted file. -
Open the Documents folder and double-click the
Encrypted.txt file. Notepad should appear and display an
"Access is denied" error message. This indicates that the file
is encrypted but you don't have a valid EFS
certificate.
EXERCISE 3 Recover Encrypted
Data
In this exercise, you recover a lost EFS key and use it to
access encrypted data. To complete this exercise, you must have
completed Exercises 1 and 2.
-
In the Documents folder, double-click the
EFS-cert-backup.pfx file that you created in Exercise
2.
The Certificate Import Wizard appears. -
On the Welcome To The Certificate Import Wizard page,
click Next. -
On the File To Import page, click Next. -
On the Password page, type the password you assigned to
the certificate. Then click Next. -
On the Certificate Store page, click Next. -
On the Completing The Certificate Import Wizard page,
click Finish. -
Click OK to confirm that the import was
successful. -
Open the Documents folder and double-click the
Encrypted.txt file. Notepad should appear and display the
contents of the file, indicating that you successfully
recovered the EFS key and can now access encrypted
files.
|
