Bitlocker Security Questions

TraderGary · Feb 2, 2025

hsehestedt said:
Yes! I love BitLocker. I've been using it for years. I use BitLocker on every single computer that I own .

I also employ a scheme that I discussed on this forum a day or two ago whereby I use a my own personally selected 48-digit key because I can compute that number in my head. Therefore I have no need to backup or store my BitLocker key anywhere .

EDIT: That discussion was in this very thread, found here:

Bitlocker Security Questions

@hdmi, you do bring up the point that Microsoft is indeed fallible. No one can ever argue that they are infallible. ;-) For me, BitLocker meets my security requirements, and I am confident using it. As always, YMMV.

www.elevenforum.com

I thought I remembered, but I wasn't sure. I started using BitLocker in 2007 when it came with Windows Vista on a new computer. After using it for 18 years, I too wouldn't be without BitLocker.

hdmi · Feb 3, 2025

TraderGary said:
Do you use Microsoft Security (Defender)?

Yes, but I use it only as an added precaution, and, I keep automatic sample submission turned off. Also I don't use any other AV protections (not even Malwarebytes...) except on very rare occasions I might decide to upload a file on Virus Total, and of course Firefox and uBlock Origin are already blocking some malicious content by default. All the AV stuff takes absolute lowest priority for me.

Win711 · Feb 3, 2025

TraderGary said:
Good point. Some people don't have anything of value on their computers.

Right. Don't carry it around if you don't need it.

TraderGary · Feb 3, 2025

hdmi said:
Yes, but I use it only as an added precaution, and, I keep automatic sample submission turned off. Also I don't use any other AV protections (not even Malwarebytes...) except on very rare occasions I might decide to upload a file on Virus Total, and of course Firefox and uBlock Origin are already blocking some malicious content by default. All the AV stuff takes absolute lowest priority for me.

I'm always in full learn mode and I didn't know Defender even had something called "automatic sample submission". So I asked CoPilot what it was.

Microsoft Defender's automatic sample submission is a feature designed to enhance the security of your device by quickly identifying and responding to new and emerging threats. Here's how it works:

How It Works:

Detection: When Microsoft Defender Antivirus detects a suspicious or malicious file, it can automatically send a sample of the file to Microsoft's cloud-based protection service for analysis.
Analysis: The cloud service quickly analyzes the file using advanced machine-learning models and threat data from a vast network of sensors.
Response: Based on the analysis, the cloud service determines whether the file is malicious or safe. If it's deemed malicious, Microsoft Defender blocks the file immediately.
Feedback: The results are sent back to the device, and the file is either blocked or allowed based on the determination.

Benefits:

Rapid Response: This process happens quickly, often within milliseconds, allowing for immediate protection against new threats.
Enhanced Detection: By leveraging cloud-based intelligence, Microsoft Defender can detect and block threats that have never been seen before.
Reduced False Positives: The cloud service helps reduce false positives by providing more accurate analysis.

Settings:

You can enable or disable automatic sample submission in the Windows Security settings. By default, it's enabled to provide the best protection, but you can choose to send only safe samples automatically or prompt for user consent before sending any samples.

I too use Defender and since I never have any problems, I'm leaving it at the default "enabled" setting.

TraderGary · Feb 7, 2025

hsehestedt said:
Yes! I love BitLocker. I've been using it for years. I use BitLocker on every single computer that I own .

Do you use BitLocker To Go on portable SSD drives?

hsehestedt · Feb 7, 2025

TraderGary said:
Do you use BitLocker To Go on portable SSD drives?

Heck yes!

Okay, this may sound way over the top nerdy, but here is what I do:

I use a PNY Elite V2 1TB thumb drive. Actually, this seems to be a full SSD supporting TRIM and all. Rated to about 550MB/s write, 600MB/s read (if memory serves correctly) but I, like most other owners, have found that the performance actually exceeds the specs. BTW, they now have version 3 which is good for 1,000 MB/s read. It's also small, even smaller than some other thumb drives.

So, I have 4 partitions on that drive:

1) FAT32, 2GB (Hidden partition). This is a bootable partition to allow for booting on any system (legacy BIOS or UEFI)
2) NTFS, 200GB (Hidden partition). This will hold whatever I want to boot and all my ISO images - more about this below
3) NTFS, BitLocker Encrypted, 600+GB - This is a backup of all my software, important documents, personal photos and videos, my entire digital life!
4) NTFS, 100GB. This a public share so I can pass along data to other people by just handing them my thumb drive.

So, I wrote my own program, similar to Ventoy. On the 2nd partition I have a folder that has any ISO images I might want to boot. All my Windows images, unattended answer files, Macrium Reflect rescue media, etc. are in that folder. When I boot from the thumb drive it will ask me what I want to boot, showing me a list of all the images. I then select what image I want to make bootable and, optionally, what unattended answer file I might want to use. It then preps the drive and when I then reboot and boot from that drive again, it boots that ISO image. So, if I'm on the road with my laptop and it takes a dump, I can boot my Macrium Reflect rescue media or Windows installation image, or anything else I need to recover.

When done, I run a batch file on the thumb drive and it reverts it back to the original state.

Bottom line is that this one drive serves as my rescue disk, a drive I can share data with other people, and storage for all my important stuff protected by BitLocker to go.

pseymour · Feb 7, 2025

@hsehestedt I was in a conference this morning about Windows, management, cloudy things, anti-malware, etc. You still had the nerdiest thing I’ve heard all day. Hat is off to you, sir.

hsehestedt · Feb 7, 2025

pseymour said:
@hsehestedt I was in a conference this morning about Windows, management, cloudy things, anti-malware, etc. You still had the nerdiest thing I’ve heard all day. Hat is off to you, sir.

Thank you! That makes my day

andrew129260 · Feb 7, 2025

hsehestedt said:
Bottom line is that this one drive serves as my rescue disk, a drive I can share data with other people, and storage for all my important stuff protected by BitLocker to go.

pseymour said:
@hsehestedt I was in a conference this morning about Windows, management, cloudy things, anti-malware, etc. You still had the nerdiest thing I’ve heard all day. Hat is off to you, sir.

Absolutely beautiful. I love it.

I also have a custom thumb drive, but nowhere near as cool as yours. It has a physical write protect switch to prevent malware from jumping onto it, usb 3.1 and has a dual boot ubuntu live and windows 11 unattended on it. It also has my own little batch file with a full menu and everything, and some of the things I use it for is installing programs or using it to remove malware etc.

I recently implemented winget into it so I don't have to store the actual exe for some of the programs on the flash drive. This way it always gets the latest version of the program.

I might need to make some improvements to it

pseymour · Feb 7, 2025

Who are you using for write-protected drives @andrew129260 ? Kanguru is who I use, but I thought about trying a Dockcase, but that doesn’t seem to be a physical switch.

TraderGary · Feb 7, 2025

hsehestedt said:
Heck yes!

Okay, this may sound way over the top nerdy, but here is what I do:

I use a PNY Elite V2 1TB thumb drive. Actually, this seems to be a full SSD supporting TRIM and all. Rated to about 550MB/s write, 600MB/s read (if memory serves correctly) but I, like most other owners, have found that the performance actually exceeds the specs. BTW, they now have version 3 which is good for 1,000 MB/s read. It's also small, even smaller than some other thumb drives.

View attachment 124627

So, I have 4 partitions on that drive:

1) FAT32, 2GB (Hidden partition). This is a bootable partition to allow for booting on any system (legacy BIOS or UEFI)
2) NTFS, 200GB (Hidden partition). This will hold whatever I want to boot and all my ISO images - more about this below
3) NTFS, BitLocker Encrypted, 600+GB - This is a backup of all my software, important documents, personal photos and videos, my entire digital life!
4) NTFS, 100GB. This a public share so I can pass along data to other people by just handing them my thumb drive.

So, I wrote my own program, similar to Ventoy. On the 2nd partition I have a folder that has any ISO images I might want to boot. All my Windows images, unattended answer files, Macrium Reflect rescue media, etc. are in that folder. When I boot from the thumb drive it will ask me what I want to boot, showing me a list of all the images. I then select what image I want to make bootable and, optionally, what unattended answer file I might want to use. It then preps the drive and when I then reboot and boot from that drive again, it boots that ISO image. So, if I'm on the road with my laptop and it takes a dump, I can boot my Macrium Reflect rescue media or Windows installation image, or anything else I need to recover.

When done, I run a batch file on the thumb drive and it reverts it back to the original state.

Bottom line is that this one drive serves as my rescue disk, a drive I can share data with other people, and storage for all my important stuff protected by BitLocker to go.

I'm doing nothing that sophisticated.

I'm using BitLocker To Go for my Macrium Reflect image backups. I have two 4TB Samsung T9 Portable SSD drives. The speed of the T9 SSD drives is a brisk 2,000 MB/s. I image a 1TB local C: SSD. Images take only 4 minutes and change to make. I alternate daily backup images between the two T9 drives. Each drive stores 7 rotating images. That's two weeks of rotating daily images to choose from if ever needed.

Macrium Reflect X is designed to handle BitLocker transparently and for me this has been an excellent image storage solution.

I love the security of BitLocker To Go as I'm mobile most of the time.

andrew129260 · Feb 7, 2025

pseymour said:
Who are you using for write-protected drives @andrew129260 ? Kanguru is who I use, but I thought about trying a Dockcase, but that doesn’t seem to be a physical switch.

yup thats what I use

Kanguru

Really good flash drive. Thinking about upgrading to this one:

Kanguru Defender Elite30 – 128 GB Hardware Encrypted Flash Drive - Physical Write Protect Switch – SuperSpeed USB 3.0

This one looks nice as well:

Kanguru UltraLock 1 TB USB-C M.2 NVMe - Portable External Solid State Drive – SuperSpeed+ USB 3.1 Gen 2

It has a management interface and everything

pseymour · Feb 7, 2025

andrew129260 said:
yup thats what I use

Kanguru

Really good flash drive. Thinking about upgrading to this one:

Kanguru Defender Elite30 – 128 GB Hardware Encrypted Flash Drive - Physical Write Protect Switch – SuperSpeed USB 3.0

This one looks nice as well:

Kanguru UltraLock 1 TB USB-C M.2 NVMe - Portable External Solid State Drive – SuperSpeed+ USB 3.1 Gen 2

It has a management interface and everything

Hahah gotta manage it in the clouds and such. Let me know if you try the UltraLock. I haven’t pulled the trigger yet.

andrew129260 · Feb 7, 2025

TraderGary said:
I'm doing nothing that sophisticated.

I'm using BitLocker To Go for my Macrium Reflect image backups. I have two 4TB Samsung T9 Portable SSD drives. The speed of the T9 SSD drives is a brisk 2,000 MB/s. I image a 1TB local C: SSD. Images take only 4 minutes and change to make. I alternate daily backup images between the two T9 drives. Each drive stores 7 rotating images. That's two weeks of rotating daily images to choose from if ever needed.

Macrium Reflect X is designed to handle BitLocker transparently and for me this has been an excellent image storage solution.

I love the security of BitLocker To Go as I'm mobile most of the time.

here you go, get this and add bitlocker. go even more crazy security haha

Kanguru Defender SED30™ M.2 NVMe Internal Self-Encrypting Solid State Drive

Hardware-based Kanguru Defender SEDs, self-encrypting internal Solid State Drives provide exceptional disk data security at rest, keeping your operating system locked and protected using state-of-the-art, self-contained implementation, with none of the performance bottlenecks of a software based...

www.kanguru.com

TraderGary · Feb 7, 2025

I've created my Rescue Media and checked BitLocker Support and Auto Unlock BitLocker. However, when I boot from the Rescue Media, I cannot see my BitLocker To Go SSD image files. What am I doing wrong?

hsehestedt · Feb 7, 2025

TraderGary said:
I've created my Rescue Media and checked BitLocker Support and Auto Unlock BitLocker. However, when I boot from the Rescue Media, I cannot see my BitLocker To Go SSD image files. What am I doing wrong?

I don't know this for a fact because I don't use that feature in Reflect because it stores your BitLocker key in plain text on the recovery media.

But if I had to guess, my guess would be that it only stores the key for the OS drive.

TraderGary · Feb 7, 2025

For all my SSD drives I've checked the option, Auto Unlock. With that option checked, whenever I attach an SSD, its totally transparent that I'm using BitLocker To Go. The drives auto unlock, and act like any normal drive. How is that done then?

TraderGary · Feb 7, 2025

I've only done a couple of restores where I wasn't able to get to my OS. In each instance, I had to go to my second computer and spend a couple of hours decrypting the T9 SSD drive before I could get to the image files for the image restore. This should not be necessary if auto unlock works like it should.

hsehestedt · Feb 7, 2025

TraderGary said:
For all my SSD drives I've checked the option, Auto Unlock. With that option checked, whenever I attach an SSD, its totally transparent that I'm using BitLocker To Go. The drives auto unlock, and act like any normal drive. How is that done then?

I used to know exactly how it does this, but my mind is like a sieve sometimes. I know where to find it but I'm literally moments from running out the door. When I get back I will do a quick research.

What I do know right offhand is that it stores some info on the BitLocker protected OS drive (which is why you can only autounlock on a system where the OS drive is BitLocker protected) and that you can clear those keys like this:

manage-bde -autounlock -clearallkeys C:

user1010 · Feb 8, 2025

Don't know if it's possible anymore but with earlier windows, the local admin password could easily get reseted with linux software.

Bitlocker Security Questions

Stock Market Wizard

My Computers

Jack of all trades – master of none

My Computers

Active member

My Computer

Stock Market Wizard

How It Works:​

Benefits:​

Settings:​

My Computers

Stock Market Wizard

My Computers

Well-known member

My Computers

Windows developer and admіn

My Computers

Well-known member

My Computers

Well-known member

My Computers

Windows developer and admіn

My Computers

Stock Market Wizard

My Computers

Well-known member

My Computers

Windows developer and admіn

My Computers

Well-known member

My Computers

Stock Market Wizard

My Computers

Well-known member

My Computers

Stock Market Wizard

My Computers

Stock Market Wizard

My Computers

Well-known member

My Computers

Active member

My Computer

Similar threads

How It Works:

Benefits:

Settings: