3

After installing Windows, I turned on Bitlocker for a full C:\ drive encryption. I saved the recovery keys and then let Bitlocker proceed with encrypting the full drive.

When I rebooted, I was surprised that the system booted completely fine without prompting for a pin. I guess Bitlocker is asking the TPM (AMD fTPM) for keys to decrypt the drive, tell me if I'm wrong.

So I tried to make the TPM require a pin before giving away all his little secrets. I found how to change the "Local Computer Policy" and configured the "Require additional authentication at startup" settings, requiring a pin.

I then proceeded to set a pin for my C:\ drive, which went perfectly fine. I rebooted and was prompted for a pin, which I thought was the end of the story.

But I wanted to test clearing the TPM to be sure that it was the component storing the keys (I have the Bitlocker recovery key, so that shouldn't be a problem). I cleared the TPM using the windows TPM GUI.

To my big surprise, when I rebooted Windows, I wasn't prompted for a pin, NOR A RECOVERY KEY! The system booted perfectly fine, but Bitlocker was in a suspended state! How is this possible after clearing the TPM? The keys should be gone forever! Have them been copied to a readable zone on my disk?

Am I misunderstanding how Bitlocker and the TPM work together?

0

Self-answering my question thanks to Ramhound's help.

When clearing the TPM, Windows automatically switches to Bitlocker's suspended mode. This mode keeps the volume key on a non-encrypted sector of the drive. When the system reboots, it uses the clear key to read the volume and takes back the ownership of the TPM, which disables suspended mode.

The following links give information on how the clear key is stored and how forensics could help reading the volume if it has been placed in suspended mode :

  • 1
    This is indeed correct. If you had cleared the TPM from the firmware, you would've been challenged for the recovery key. Windows is just making things convenient for you by suspending protection first, then re-enabling it after a reboot, when it can re-save the keys back to the TPM. – Wes Sayeed Jan 9 at 21:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.