How to avoid explicit signs of BITLOCKER encryption

wosxis · 03 Apr 2021

Please only replies from people who have at least some knowledge of the topic.

Is there any solution to create a Windows 10 Bitlocker encrypted installation and to remove as many indicators as possible that indicate the system is actually Bitlocker encrypted?
This would be useful, for example, in case that someone who wants to access your data and sees there is a Bitlocker encrypted system in your device forces you to divulge the password. The solution isn't meant to counter forensic analysis or create full plausible deniability but at least to achieve some plausible deniability by removing clear and obvious signs of a Bitlocker encrypted system and if possible remove them all.

I was thinking a solution could be by having two installations of Windows 10 on the same device, one installation is clear and the other is Bitlocker encrypted but in this case the clear signs of Bitlocker would be:
- the boot manager displaying two Windows options
- the Bitlocker bootloader asking for password (it would be useful to be able to store it in an external usb key)
- the Windows system reserved partitions which, I'm not sure, could store Bitlocker reserved data
- the clear Windows installations would show the Bitlocker encrypted partition

Do you have any solution or suggestions to achieve this?

sygnus21 · 03 Apr 2021

Not quite sure I understand your question/reasoning?

I use BitLocker, and have been using it a while. Currently using it now. There are indicators a drive is BitLockered via a lock icon on the drive using BitLocker, and from the BitLocker Drive Encryption panel telling you what drives are using BitLocker.

You can also find the status using Command Prompt, or Powershell... Check BitLocker Drive Encryption Status in Windows 10

All that said, I'm not aware that this info can be hidden. Fact is, I never thought about it. Anyway, and to be clear, forensics will detect the status of a drive and whether it was encrypted or not. Some things are deeply embedded only to be found with the correct tools.

Oh, BTW, you can save a BitLocker key anywhere you want except on the drive being encrypted. That makes sense since you'd need to access the key to get into the drive. You can also have the key automatically saved to your Microsoft Account - this is the default setting if you have one.

wosxis · 05 Apr 2021

Obviously I'm talking about "indicators" that the system is Bitlocker encrypted when it is shutdown, there is no reason if the system in on and the wrong user has already access to it :/