Privacy and Security Turn On BitLocker for Removable Data Drive in Windows 11

This tutorial will show you how to turn on or off BitLocker To Go to encrypt or decrypt a removable data drive in Windows 10 and Windows 11.

BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned drives and computers.

New files are automatically encrypted when you save them to a drive encrypted by BitLocker. However, if you copy these files to another drive or a different PC not encrypted by BitLocker, the files are automatically decrypted.

BitLocker To Go is BitLocker Drive Encryption on removable data drives. This includes the encryption of USB flash drives, SD cards, external hard disk drives, and other drives formatted by using the NTFS, FAT16, FAT32, or exFAT file systems.

You can choose to unlock BitLocker for a removable data drive with a password or a smart card. You can set the removable data drive to automatically unlock after encrypted when you sign in to Windows.

BitLocker Drive Encryption is only available in the Windows 10/11 Pro, Enterprise, and Education editions.

EXAMPLE: BitLocker turned on for removable data drive in File Explorer > This PC, and if you choose to unlock removable data drive with password





Here's How:

1 If you like, set a default encryption method (XTS-AES or AES-CBC) and cipher strength (128 bit or 256 bit) you want used by BitLocker.

BitLocker Drive Encryption uses AES-CBC 128 bit by default for removable data drives.

XTS-AES 256 bit offers the strongest encryption strength available for BitLocker.

2 Right click or press and hold on the removable data drive (ex: "F") you want to encrypt with BitLocker, click/tap on Show more options, and click/tap on Turn on BitLocker. (see screenshot below)


3 Choose how (ex: password or smart card you want to unlock the removable data drive. (see screenshot below)

A password requires at least 8 characters.

4 Select how (Microsoft account, file, and/or print) you want to back up your BitLocker recovery key for this removable data drive. (see screenshot below)

Microsoft account = This option is only available if you are signed in to Windows with a Microsoft account. It will save the BitLocker recovery key to your Microsoft account online at https://account.microsoft.com/devices/recoverykey.

File = This option will save the BitLocker recovery key to a TXT file at a folder location you select.

Print = This option will print the BitLocker recovery key to the selected printer.

5 When finished backing up your BitLocker recovery key where you want, click/tap on Next. (see screenshot below)


6 Select (dot) Encrypt used disk space only or Encrypt entire drive for how much of your drive to encrypt right now, and click/tap on Next. (see screenshot below)

It is recommended to select Encrypt entire drive.

7 Select (dot) which encryption mode to use, and click/tap on Next. (see screenshot below)

If you did step 1 above to set a default encryption method and cipher strength, then you will not have this setting available since BitLocker will use what you set in step 1 instead.

New encryption mode (XTS-AES 128-bit) = Select this mode if this is a fixed drive or if this drive will only be used on devices running Windows 10 or Windows 11.

Compatible mode (AES-CBC 128-bit) = Select this mode if this is a removable drive that you're going to use on an older version of Windows (ex: Vista, Windows 7, or Windows 8/8.1).

8 Click/tap on Start encrypting when ready. (see screenshot below)


9 The removable data drive will now start encrypting. (see screenshot below)

This could take a long time to finish depending on the size of the drive and how much data on the drive is being encrypted.

10 When encryption has finished, click/tap on Close. (see screenshot below)



That's it,
Shawn Brink