How to avoid explicit signs of BITLOCKER encryption


  1. Posts : 7
    windows 10
       #1

    How to avoid explicit signs of BITLOCKER encryption


    Please only replies from people who have at least some knowledge of the topic.

    Is there any solution to create a Windows 10 Bitlocker encrypted installation and to remove as many indicators as possible that indicate the system is actually Bitlocker encrypted?
    This would be useful, for example, in case that someone who wants to access your data and sees there is a Bitlocker encrypted system in your device forces you to divulge the password. The solution isn't meant to counter forensic analysis or create full plausible deniability but at least to achieve some plausible deniability by removing clear and obvious signs of a Bitlocker encrypted system and if possible remove them all.

    I was thinking a solution could be by having two installations of Windows 10 on the same device, one installation is clear and the other is Bitlocker encrypted but in this case the clear signs of Bitlocker would be:
    - the boot manager displaying two Windows options
    - the Bitlocker bootloader asking for password (it would be useful to be able to store it in an external usb key)
    - the Windows system reserved partitions which, I'm not sure, could store Bitlocker reserved data
    - the clear Windows installations would show the Bitlocker encrypted partition

    Do you have any solution or suggestions to achieve this?
      My Computer

  2. sygnus21's Avatar
    Posts : 5,629
    Win 10 Pro (x64) 21H1 (19043.1023
       #2

    Not quite sure I understand your question/reasoning?

    I use BitLocker, and have been using it a while. Currently using it now. There are indicators a drive is BitLockered via a lock icon on the drive using BitLocker, and from the BitLocker Drive Encryption panel telling you what drives are using BitLocker.

    You can also find the status using Command Prompt, or Powershell... Check BitLocker Drive Encryption Status in Windows 10

    All that said, I'm not aware that this info can be hidden. Fact is, I never thought about it. Anyway, and to be clear, forensics will detect the status of a drive and whether it was encrypted or not. Some things are deeply embedded only to be found with the correct tools.

    Oh, BTW, you can save a BitLocker key anywhere you want except on the drive being encrypted. That makes sense since you'd need to access the key to get into the drive. You can also have the key automatically saved to your Microsoft Account - this is the default setting if you have one.
      My Computers


  3. Posts : 7
    windows 10
    Thread Starter
       #3

    Obviously I'm talking about "indicators" that the system is Bitlocker encrypted when it is shutdown, there is no reason if the system in on and the wrong user has already access to it :/
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 04:44.
Find Us




Windows 10 Forums