Enabling BitLocker on USB Flash Drives
Encrypting USB flash drives protects the data stored on the volume.
Any USB flash drive formatted with FAT, FAT32, exFAT or NTFS can be
encrypted with BitLocker.
The length of time it takes to encrypt a drive depends on the size of
the drive, the processing power of the computer, and the level of
activity on the computer.
Before you enable BitLocker,
you should configure the appropriate Removable Data Drives policies and
settings in Group Policy and then wait for Group Policy to be
refreshed. If you don’t do this and you enable BitLocker, you might need to turn BitLocker off and then turn BitLocker back on because certain state and management flags are set when you turn on BitLocker.
To be sure that you can recover an encrypted volume, you should
allow data-recovery agents and store recovery information in Active
Directory. If you use a flash drive with earlier versions of Windows,
the Allow Access To BitLocker-Protected Removable Data Drives From
Earlier Versions Of Windows policy can ensure that you have access to
the USB flash drive on other operating systems and computers. Unlocked
drives are read-only.
To enable BitLocker encryption on a USB flash drive, follow these steps:
-
Insert the USB flash drive. In File Explorer, press and hold or
right-click the USB flash drive, and then tap or click Turn On
BitLocker. BitLocker then verifies that your computer meets its
requirements and then initializes the drive.
-
On the Choose How You Want To Unlock This Drive page, choose one or more for the following options, and then tap or click Next:
-
Use A Password To Unlock This Drive
Select this option if you want the user to be prompted for a password
to unlock the drive. Passwords allow a drive to be unlocked in any
location and to be shared with other people.
-
Use My Smart Card To Unlock The Drive
Select this option if you want the user to use a smart card and enter
the smart card PIN to unlock the drive. Because this feature requires a
smart card reader, it is normally used to unlock a drive in the
workplace and not for drives that might be used outside the workplace.
-
On the How Do You Want To Back Up Your Recovery Key? page, tap or click Save The Recovery Key To A File.
-
In the Save BitLocker Recovery Key As dialog box, choose a save location, and then tap or click Save.
-
You can now print the recovery key if you want to. When you have finished, tap or click Next.
-
If allowed in Group Policy, you can elect to encrypt used disk space
only or the entire drive and then tap or click Next. Encrypting the
used disk space only is faster than encrypting an entire volume. It is
also the recommended option for newer computers and drives (except in
high-security environments).
-
On the Are You Ready To Encrypt This Drive? page, tap or click Start
Encrypting. Be sure to pause encryption before removing the drive and
then resume to complete the encryption. Do not otherwise remove the USB
flash drive until the encryption process is complete. How long the
encryption process takes depends on the amount of data to encrypt and
other factors.
The encryption process does the following:
-
It adds an Autorun.inf file, the BitLocker To Go reader, and a Read Me.txt file to the USB flash drive.
-
It creates a virtual volume with the encrypted contents of the drive.
-
It encrypts the virtual volume to protect it. USB flash drive
encryption takes approximately 6 to 10 minutes per gigabyte to
complete. The encryption process can be paused and resumed, provided
that you don’t remove the drive.
When you insert an encrypted drive into a USB slot on a computer
running Windows 8, Windows 8 displays a notification on the secure
desktop, as shown in Figure 2. If the notification disappears before you can tap or click it, simply remove and then reinsert the encrypted drive.
Tap or click the notification to display the BitLocker dialog box shown in Figure 3. This dialog box also is displayed on the secure desktop.
When you are prompted, enter the password. Optionally, tap or click
More Options to expand the dialog box so that you select Automatically
Unlock On This Computer to save the password in an encrypted file on
the computer’s system volume. Finally, tap or click Unlock to unlock
the drive so that you can use it.
If you forget or lose the password for the drive but have the
recovery key, tap or click More Options and then tap or click Enter
Recovery Key. Enter the 48-digit recovery key and then tap or click
Unlock. This key is stored in the XML-formatted recovery key file as
plain text.
