I'm using Bitlocker without TPM to encrypt my SSD (Windows 10) and I have a question about suspending Bitlocker.

This site states:

Disable keeps the data encrypted but encrypts the BitLocker volume master key with a clear key. The clear key is a cryptographic key stored unencrypted and unprotected on the disk volume. By storing this key unencrypted, the disable option allows for changes or upgrades to the computer without the time and cost of decrypting and re-encrypting the entire volume. Once the changes are made and BitLocker is again enabled, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade, and the clear key is erased.

My question is: Once the clear key is written unencrypted to a SSD, how is it erased after that?

On a normal HDD I would assume that the sector containing the clear key is overwritten multiple times. But a SSD is allowed to map a "sector address" first to "flash cell X" and later to another "flash cell Y". So in this case the clear key would still be readable in "flash cell X". Or is there a way for the Operating System to enforce writing to a specific "sector address"?

E.g. iOS Devices have an "Effaceable Storage" which can bypass wear-leveling:

This feature accesses the underlying storage technology (for example, NAND) to directly address and erase a small number of blocks at a very low level.

I couldn't find a similar feature in Windows or in commonly used SSDs. But I also don't think that the engineers at Microsoft didn't come up with a solution for this.

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.