0

I have 1 SSD drive split into 2 partitions with the system (Windows 10 Pro 20H2) on 1 (C) and data on the other (D). This install is 2 months old. I bought a TPM chip, it's not placed on the mother board yet.

Is it possible to retroactively encrypt the full SSD (so C and D) without having to do a clean install?

From the Bitlocker options it looks like I can only encrypt at partition level and not FDE. I also would like to be able to log into my Windows session with a PIN password and be done with Bitlocker.

How to proceed? Thanks

1 Answer 1

0

If the TPM works in your system then you can simply encrypt the system drive/partition first. Once that is done you can encrypt a number of secondary drives/partitions and "chain" it to the system drive. Therefore unlocking of the secondary drive is automatically done directly after start-up.

Regarding the login: You can bitlocker use in the "TPM mode without PIN", then login would remain as it is at the moment. But this mode is not very secure as there are attacks using inserted PCIExpress cards that can get read the Bitlocker key from memory (DMA access) using direct memory access. On older systems this was even possible using a Firewire connection. Modern CPUs/system should contain protection against DMA attacks but I am not sure how good that works in that scenario.

If you use TPM+PIN which is the best solution then you would have to authenticate two times, first before Windows boot Bitlocker login, and then after boot the regular Windows logon.

No matter what you do don't forget to print out the Bitlocker recovery keys. If something in your BIOS changes the TPM can't unseal the key and you have to enter the recovery key to get Bitlocker running again. Therefore no recovery usually key means complete data loss.

Additionally before starting the drive encryption make sure you have performed a full backup on drive image level - just remember

No Backup - No Mercy

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .