I recently looked in the Disk Management tool, and I noticed a (virtual) disk that I didn't recognize. The volume's name is "PortableBaseLayer."

I also noticed it while using the manage-bde -status command. It concerned me, as my whole disk is supposed to be encrypted by BitLocker. Please see the images below.

Can anyone tell me anything about this?

enter image description here

enter image description here

migrated from security.stackexchange.com Oct 21 at 10:03

This question came from our site for information security professionals.

  • Your entire physical disk is indeed encrypted. PortableBaseLayer is a virtual HDD that you have mounted which is not encrypted. It is currently mounted in a read-only state. – Ramhound Oct 21 at 16:53

PortableBaseLayer is a mounted virtual drive (.vhdx). I went through a lot of forum discussions on this topic. Many users claim that it is a part of Windows Sandbox. Some say that it is related to the recently announced Reserved Storage. It is not just for Sandbox, but it is special storage introduced in v1903 to accommodate Windows Update space requirements and temporary space for apps. It is even seen when you enable only Windows Defender Application Guard.

Whatever you feel, do not delete this volume. If it’s there, then its because the OS wants it to be there for its usage.

  • Should I be concerned about it being listed as decrypted in the output for “manage-bde-status” above? – Daniel Oct 21 at 12:03
  • @Daniel - The virtual HDD wasn't encrypted in the first place, so the only status it should be, is to be unencrypted/decrypted. – Ramhound Oct 21 at 16:54
  • @Ramhound thanks – Daniel Oct 29 at 2:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.