1

I want to encrypt my hard drive using BitLocker, but it requires me to create a recovery key. Now, I understand why this is important, as there may be cases where my password alone can't unlock the drive, such as if the user profile gets corrupted. The problem is that if a determined thief gets my hard drive, then they might be able to get my recovery key as well, assuming I actually keep it in my house, on my person, or anywhere remotely connected to me. Of course, if my password is STILL required to unlock the drive, then the thief can't access my data. However, if the recovery key ALONE can unlock the drive, then there's absolutely nothing to stop the thief from accessing my data. It would be like a burglar entering somebody's house using a key from underneath a potted plant.

What am I missing? How do ensure, on the one hand, that I won't ever be locked out of my data so long as I remember my password, and on the other hand, that I'm not creating something that a thief could use to bypass my password.

Note: I'm not using TPM.

2
  • 1
    recovery key can only be made after entering the correct password, once you make the key store it in a safe place. If they steal your drive they cannot make another recovery key unless they have the current password.
    – Moab
    Feb 18, 2016 at 23:16
  • 1
    Delete it. If it doesn't exist it cannot be used.
    – Ramhound
    Feb 19, 2016 at 1:39

4 Answers 4

4

Short answer: Store your recovery key in a safe place. Maybe, for you, that's Google Drive, a flash drive you keep on your key-chain, or in an email you send to yourself.

The thief cannot generate a recovery key unless they are logged in to your computer. If they steal the drive without first getting the recovery key or your password than Bitlocker is doing it's thing.

What you're asking for is 'how can I make a key which no one else can use which lets me get in if I forget my password' and the short answer is you can't. If you make the key, make it hard to find. If you don't make the key, don't forget your password. I

t's a common trade off in security: ease of use <--> strength of security

As @Ramhound said. The additional/secondary use of the recovery key is if the hardware the drive was connected to changed. You would need it to access the data at that point.

Per @user1751825 "There is one other situation where you may require the recovery key. If you need to unlock your drive using the command line manage-bde utility I believe you may need the recovery key."

11
  • 2
    Don't email it to yourself. This is nowhere near secure enough. Bitlocker provides the option to upload to your one-drive account. This would be preferable to storing it in an email. Feb 18, 2016 at 23:27
  • @user1731825 As with most things, it's relative. If it's a personal laptop you don't care a tremendous amount for an you work at a company with intense email security, it's pretty low risk. Another use case is running your own exchange/postfix server where you manage the security. If you trust it enough, what is wrong with using it? I agree it's less ideal but it's also not a physical thing and it may avoid cloud storage.
    – Abraxas
    Feb 18, 2016 at 23:50
  • 1
    Even disregarding the potential security implications, email isn't designed to be a general purpose storage system. It's too easy to accidentally delete or misplace things. I know a lot of people do it, but it's really not something that should be encouraged. Like storing things in the recycle bin for later retrieval. Feb 19, 2016 at 0:00
  • Again, was just providing an answer. I don't agree with using it for storage but people do and with the increase in availability of archive mailboxes and things like that it is not the 'worst' idea. But I would absolutely say to the OP not to store it in email.
    – Abraxas
    Feb 19, 2016 at 0:02
  • 1
    I agree. It's not the worst idea, but there are simpler, safer options which really aught to be considered first. Feb 19, 2016 at 0:05
1

The recovery key is only needed if you forget your password, so requiring the password when using the recovery key would be counter intuitive. If you're certain you'll never forget your password, then you don't need to keep the recovery key. This is risky though. I think simply keeping the recovery key in a secure location should be sufficient.

Update... The manage-bde command line utility only works with the recovery key, not the password. It unlikely in normal use to need this utility though.

5
  • If you type manage-bde -unlock -help, then you can see that recovery key is not only option for unlock. -Password is one of supported options.
    – user364455
    Feb 20, 2016 at 5:06
  • @PetSerAl That's true. However it does have limitations. This parameter doesn't accept a password at the command line, but opens a prompt dialog to allow the user to enter the password. This means it cannot be used in the windows recovery environment for example. Also if you need to script the lock/unlock command, to have it run non-interactive, you'll need the recovery password/key, as the -Password option will not work. Feb 20, 2016 at 9:59
  • But you still can use wmic for scripting: wmic /namespace:\\Root\CIMV2\Security\MicrosoftVolumeEncryption path Win32_EncryptableVolume where DriveLetter='X:' call UnlockWithPassphrase Passphrase='Password'
    – user364455
    Feb 20, 2016 at 10:25
  • @PetSerAl Thanks for that. I was unaware of this alternative means of scripting. it looks very interesting. Feb 20, 2016 at 11:29
  • @user364455 thanks for good comment. So, that should work when the drive that asks RECOVERY KEY , but I only know password, right? however, can you tell why that gives error Invalid named parameter list in powershell? in CMD it shows Method execution successful. Out Parameters: instance of __PARAMETERS { ReturnValue = 123456789xxx; }; but drive still not unlocked and still asks for recovery key. thanks in advance.
    – T.Todua
    Nov 21, 2021 at 5:59
0

Why not take the recovery file and encrypt it? Using another passphrase you definitely won't forget, that's different from the "main" bitlocker passphrase you're trying to protect.

Using PGP/GPG or LUKS or even TrueCrypt (still) should be safe.

Then it would be much safer to upload it to some online storage, but if something damages your computer (fire, theft, etc) then there's no real reason to keep the recovery file off-site anyway (it's useless without the then-unavailable bitlocker data)

-1

Store the key in your microsoft account. Only those who have access to your microsoft account can get the key. If you can't log in to your computer, use another nearby computer or laptop to go here

https://support.microsoft.com/en-us/instantanswers/566e0e4e-4ca7-4df2-88fb-aa71c00ea55e/find-my-bitlocker-recovery-key

Here is the instruction straight from microsoft

Places to look for your BitLocker key:

On a printout you saved. Look in places you keep important papers.
Saved on a USB flash drive. Plug the USB flash drive in to your locked PC and follow the instructions. If you saved the key as a text

file on the flash drive, use a different computer to read the text file. In your Microsoft account. To get your recovery key, go to BitLocker Recovery Keys.

Or ask someone for help:

Ask someone with administrator privileges on the same PC to unlock it with their key.
If your PC is connected to a domain (usually a work or school computer), ask a system administrator for your recovery key.

If you still can't get in, you'll need to reset your PC. Learn how.

it's similar with putting it in google drive or dropbox but I think it's much better. In google drive you may forget where you store the key. In google drive this is just another text file that may be lost somewhere.

With microsoft they don't just store it on onedrive (which is microsoft's dropbox btw). You won't see the key on your one drive. Microsoft have a special place to store the key just for you. So it's not just another text file. It's really a special feature made by the one company that makes the bitlocker system. It's much more easily found. It's more secure. You need to verify your identity on the phone first before you can sign in. And you got it on text, not just text file.

Also if you have several keys or hundreds of computer, microsoft will name the computer where each key belong.

If you save it on google drive you just have to try it one by one I guess. Yea technically the recovery key has file name you can match too. Still, it's far more convenient to get a key under the name of Jim-PC instead of key 12234-fdfdg-blabla-blublu

You basically store the key with the same account you use to log in to your computer. The only way you will fail is if you forget pass to that account but that means you can't logged in to your computer anyway. If you are me, I may have several google drive not necessarily linked to my microsoft account. So I think it's just more appropiate to use microsoft key using microsoft service.

1
  • How is this different from storing it on Google Drive?
    – Ramhound
    Oct 7, 2016 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.