1

A Windows 10 laptop's hard drive was encrypted with Bitlocker and has been physically removed from the laptop and is now being used as an external device. The Bitlocker recovery key is used to access this hard drive as an external device and there are no issues there.

On this device there are old system files in the "Windows" folder and "Program Files" folder. I would like to delete some of these files to free up space. My question is: if I delete certain files, will I mess up the Bitlocker encryption to the extent that I won't be able to unlock the hard drive with the recovery key? Are there essential files for the Bitlocker encryption sitting in either the "Windows" folder or the "Program Files" folder? If so, which ones are they, so I can keep those and delete the rest?

migrated from security.stackexchange.com Jun 18 at 8:55

This question came from our site for information security professionals.

  • This might help you with understanding how Bitlocker works. – Rahul May 30 at 10:00
0

According to this link: https://docs.microsoft.com/en-us/windows/security/information-protection/encrypted-hard-drive

"Encrypted Hard Drive Architecture

Encrypted Hard Drives utilize two encryption keys on the device to control the locking and unlocking of data on the drive. These are the Data Encryption Key (DEK) and the Authentication Key (AK).

The Data Encryption Key is the key used to encrypt all of the data on the drive. The drive generates the DEK and it never leaves the device. It is stored in an encrypted format at a random location on the drive. If the DEK is changed or erased, data encrypted using the DEK is irrecoverable. "


It sounds to me like there is in fact an important file which is encrypted and stored randomly on the hard drive; probably in the "Windows" folder or "Program Files" folder. The odds of finding this file seems low and the risk of corrupting the drive by deleting these folders seems high.

The best solution that I am seeing at the moment is to keep these folders on the hard drive and forgo using that storage space for another purpose.

Alternatively, I could upgrade to Windows 10 Pro (which I don't have - I have Windows 10 Home), decrypt the hard drive and then delete the "Windows" folder and "Program Files" folder.

I can decrypt the device in Windows 10 Pro by:

1) connect the device and unlock it

2) open an elevated command prompt (rightclick cmd.exe and select "run as administrator") and launch the command

3) Launch the command

manage-bde -off d:

(substitute d: for the correct drive letter)

These steps can be found here: https://social.technet.microsoft.com/Forums/en-US/077ab7af-1d95-43e2-819c-4f3d606201b3/windows-10-home-decryption-of-external-drive-using-bitlocker?forum=win10itprosecurity


All things considered, until I stumble upon a friend that has Windows 10 Pro (I have Windows 10 Home) and do the above steps, I will not delete the "Windows" or "Program Files" folders.

  • 1
    Regarding "It sounds to me like there is an important file...". This is simply not true, and your reference does not say so. Bitlocker does not create visible/accessible files on encrypted volumes. – DoubleD May 30 at 21:39
0

The Bitlocker key protectors and DEK are not accessible via normal file system operations. I.e., copying, deleting, renaming, or moving files will have no effect whatsoever. You can safely delete any files on the volume without any ill effects.

You would have to be careful with disk utilities, however. If you want to manipulate the partitions or perform maintenance tasks on the physical drive, then you'll need to use tools that will not cause problems.

The answer by jsubw is simply wrong; I have performed similar tasks in the past without any problems. The DEK is not stored in a file, and, in fact, you can enable and use Bitlocker on a completely empty drive.

Edit:

jsubw does correctly indicate that you can remove Bitlocker from the drive, however, if that is your preference. You can also create a new key protector with the manage-bde command---a simple password might be easier to use than the recovery key.

manage-bde  protectors add E: -password YOURNEWPASSWORD

If you substitute your drive letter for E: and your password for YOURNEWPASSWORD, you would be able to unlock the drive with that password in the future.

The recovery key would continue to work in addition to the password, unless you choose to remove it with the manage-bde protectors remove command.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy