Bitlocker Security Questions

dacrone · Feb 11, 2025

hsehestedt said:
Okay, so clearly there does exist a .BEK file, but I just cannot find it. Here is info for my Z: drive. Note that it does indeed reference a .BEK file...

View attachment 124723

Check response by telcoM.
.https://superuser.com/questions/1674672/where-is-my-bitlocker-bek-file

Also - it’s a system protected file, so once new one is created and old one invalidated, you can search new directory for it but make sure to show system protected files before searching.

Here’s a tool that can locate it too
.https://github.com/northloopforensics/Bitlocker_Key_Finder?tab=readme-ov-file

kelper · Feb 11, 2025

So long as your BIOS setup utility is pssword protected, even if your laptop is 'on' but locked, a bad actor can't bypass your security even with physical access. He could power up or restart, press F2 or whatever to boot into BIOS but then he needs the password.

TraderGary · Feb 11, 2025

newmann said:
So you seldom power your laptop off. That means laptop is plugged in overnight or not? However, you said you like to move around a lot so you rarely have it plugged in then unless you are home? So you took a face id picture and that is your login? But you could use a 16 digit passphrase as well. That passphrase is the windows 11 password correct?

I turned OFF the Windows Account password. A hacker must have my biometrics and I'm comfortable with that security.

newmann said:
Yea when I'm away from my laptop for a while, I don't want to turn it on and open all the programs that I want opened. So I just lock it whether I go outside or overnight. Then I just enter my windows 11 pro password into it and get in my laptop. So that is safe then right even if someone had access to my laptop if I'm not there? They can't put a usb flash drive and put malware on my laptop right if it's locked? That is what I want to know here. The same like if someone got to your laptop and opened the lid. The thing is they can't turn it on because of no face id and they don't have the 16 digit passphrase. But if they plug a usb with malware to your USB ports, would that work or not?

You honestly think that someone would break into your house only to attach a USB drive to introduce malware to your PC? Ask yourself why wouldn't they just steal the PC? Your question really makes no sense.

newmann said:
Okay when you go to coffeeshop, laptop is always in your backpack. So you never turn it off and just close the lid before you put it in your backpack right. Then when you use it again, you open lid and face id recognize you and you back? But say someone had your laptop for a few minutes and had a malicious usb flash drive. They can't put malware in your laptop right? I know you say the situation is not possible but I'm saying let say they had access to it. That is what I want to know from this with bitlocker. I know that if someone has access to my laptop and it isn't turned on, they can't get into my laptop unless they have my bitlocker pin and windows 11 pro password or my bitlocker recovery key... correct? But if they got my bitlocker pin and then get to the next screen which is the windows locked screen, can they get in? I assume not? And in no situation can they put malware on my laptop with a USB flash drive or anything unless they get into my laptop right? That is what I want to know. I keep my laptop locked when going outside or overnight but do I need to power it off? Thus powering it off would mean someone needs bitlocker pin as well... but this is hassle for me as I would have to power off and then power on laptop again when I start using it.

You're comfortable typing in a BitLocker PIN and then typing in a password whenever you turn your PC on. That's way too cumbersome for me. I prefer just opening the lid, Windows Hello instantly recognizes me, and I immediately start working.

When away from home, my laptop is always fully under my control and is always in my physical possession. All your "what if's" have no meaning for me.

kelper · Feb 11, 2025

He was only asking! As you seem well up on security - they were all hypotheticals.

TraderGary · Feb 11, 2025

kelper said:
He was only asking! As you seem well up on security - they were all hypotheticals.

I like to eliminate as many hypotheticals as possible. That's just me.

TraderGary · Feb 11, 2025

@newmann, you're extremely focused on security. An essential part of good security is a good backup strategy. What is your backup strategy?

kelper · Feb 11, 2025

@TraderGary is your BIOS setup utility password protected?

TraderGary · Feb 11, 2025

kelper said:
@TraderGary is your BIOS setup utility password protected?

Yes.

kelper · Feb 11, 2025

TraderGary said:
Yes.

But you would say that, wouldn't you?

TraderGary · Feb 11, 2025

kelper said:
But you would say that, wouldn't you?

Of course!

@kelper, Is your BIOS setup utility password protected?

kelper · Feb 11, 2025

No. But I don't have valuable data on it.

andrew129260 · Feb 11, 2025

I use the following:

Bios password / set to only boot internal ssd and not allow any other boot device. secure boot on of course. Virtualization security on. Driver blacklist on.
Bitlocker pin at startup
Microsoft Account (for blocking password resets easily done through a local account, but I learned that doesn't matter much anymore)
Account lockout for an hour after 2 invalid attempts. (I know my password and never mistyped it.)
No other accounts are allowed log on
Smart app control is on.
Ransomware protection is on.
Built in admin account is renamed. Same as Guest account.
Built in admin account has to use uac at highest level
Important files are encrypted with 7-zip's password encryption.
Lock screen has no shut down and restart menu. Accessibility button is removed.

Why the need for all the security? Honestly no reason at all. I don't have much sensitive stuff. But I do like to play around and see what I can get past or break in my own time. So far, this method has held up quite well. Of course I am not a hacker or anything, but I like to see whats secure, as I have people I assist that need strong security, so if it's good enough for me it should be good enough for them.

TraderGary · Feb 11, 2025

kelper said:
No. But I don't have valuable data on it.

For the past 25 years I've made my living trading. I've accumulated 25 years of data and experience that I use in my work. My security is important to me. I'm always open to ways to improve.

kelper · Feb 11, 2025

I think we all understand that!

No disrespect intended.

newmann · Feb 13, 2025

Can you explain the BIOS password protected? You have to manually do that right? I do not have that done. So that means someone could turn on my laptop and press F2 and get into my BIOS then even if I have bitlocker on with the bitlocker pin and windows 11 pro password?

You say you are a trader. Well I am using examples like what if a hacker wants to get in your computer. The USB malware thing... well if someone would put that in your USB port and you don't know and your computer gets malware, they could detect everything you type in on your computer and all that. So imagine when you log into online banking or your trading account, they know your password. So that person could get into your accounts unless you have 2FA. Or imagine that person goes into your online banking and drains your account. I am talking about those examples. You say, well why don't that person just take the laptop? Well, if the laptop is off and they don't know your bitlocker pin and windows 11 password or they thing you use to log in, they can't get in your laptop. If they put malware on your laptop and put a keylogger, anything you type in would be available to them. Does that make sense?

So my question is, if your laptop is turned on but it is on the lock screen where you need to enter the windows 11 password to get back to your laptop, can someone put malware on it somehow? Whether putting a USB flash drive with malware or something else? It would be tougher with the laptop off since they would need the bitlocker pin as well. Or if they have the bitlocker recovery code, well that would work. The thing is if don't have your BIOS password protected, does this mean bitlocker and windows 11 password is useless? I don't have the BIOS password thing that is mentioned. Is that easy to do or not? I think it is good to talk about different situations. You say you always have your laptop with you. Well if somehow a thief got it which can happen, your laptop information is safe right?

kelper · Feb 13, 2025

If a PC is locked then a bad actor can't use a USB on it. So stop worrying.

hdmi · Feb 13, 2025

kelper said:
If a PC is locked then a bad actor can't use a USB on it.

This is still very often incorrect.

kelper · Feb 13, 2025

hdmi said:
This is still very often incorrect.

If you contradict, at least justify!

hdmi · Feb 13, 2025

kelper said:
If you contradict, at least justify!

As a matter of true fact, it's right here in this very thread. Buried underneath a dozen pages of mostly internet noise complete with regurgitations of what Microsoft has claimed despite that took 43 seconds to refute with evidence. lmao

TraderGary · Feb 13, 2025

The reality is that nothing can be 100% guaranteed safe and 100% guaranteed foolproof. What we do is take steps to reduce the likelihood of bad actors messing with us to be as miniscule as possible. That's all we can do.

I'm mobile a good bit of the time, so I take steps to reduce the likelihood that a bad actor can harm me. I'm confident that the steps I take are effective enough that I'm comfortable with what I do.

The most effective thing you can do is be smart about how you handle your online life. Don't click on anything you shouldn't. @newmann, from what you type, you already know how to be careful, and you have taken logical steps to protect yourself. Your steps are different from mine, but it doesn't mean that either one of us is necessarily better. The bottom line is that you do what makes you feel most comfortable.

I'm always in full learn mode and it looks like you are too. Keep reading and keep learning!

Bitlocker Security Questions

Well-known member

My Computer

Well-known member

My Computers

Stock Market Wizard

My Computers

Well-known member

My Computers

Stock Market Wizard

My Computers

Stock Market Wizard

My Computers

Well-known member

My Computers

Stock Market Wizard

My Computers

Well-known member

My Computers

Stock Market Wizard

My Computers

Well-known member

My Computers

Well-known member

My Computers

Stock Market Wizard

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Jack of all trades – master of none

My Computers

Well-known member

My Computers

Jack of all trades – master of none

My Computers

Stock Market Wizard

My Computers

Similar threads