Suspending BitLocker: Clearing Key and Erasing Permanently
BitLocker is a full disk encryption feature included with Windows Vista and later. It is designed to protect data by providing encryption for entire volumes. According to BitLocker FAQs, "Suspending keeps data encrypted, encrypts BitLocker volume master key, and clears the key protector." This article will cover the key concepts of suspending BitLocker, clearing the key, and erasing it permanently.
Suspending BitLocker
Suspending BitLocker is the process of temporarily disabling the encryption on a protected drive. This can be useful when you need to perform maintenance or troubleshooting on the drive, but still want to ensure that the data remains encrypted. When BitLocker is suspended, the volume master key is encrypted and stored in the clear key protector. The clear key protector is a key that is not encrypted and can be used to unlock the drive. It is important to note that suspending BitLocker does not decrypt the data on the drive, it only makes it possible to access the data without providing the BitLocker recovery key.
Clearing the Key
Clearing the key is the process of removing the clear key protector from the BitLocker-protected drive. When the clear key protector is removed, the volume master key is no longer encrypted and stored in the clear key protector. This means that the data on the drive is no longer accessible without the BitLocker recovery key. Clearing the key is a permanent action and cannot be undone. It is important to make sure that you have the BitLocker recovery key before clearing the key, as this is the only way to access the data on the drive.
Erasing the Key Permanently
Erasing the key permanently is the process of deleting the BitLocker recovery key. When the recovery key is deleted, the data on the drive is no longer accessible. This is a permanent action and cannot be undone. It is important to make sure that you have made a backup of the data on the drive before erasing the key permanently, as this is the only way to recover the data.
Code Block: Suspending BitLocker using PowerShell
# Suspend BitLocker on drive C:
Suspend-BitLocker -MountPoint "C:"
Code Block: Clearing the Key using PowerShell
# Clear the key on drive C:
Clear-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId <KeyProtectorId>
Code Block: Erasing the Key Permanently using PowerShell
# Erase the key permanently on drive C:
Remove-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId <KeyProtectorId>
- Suspending BitLocker keeps data encrypted and encrypts the BitLocker volume master key, making it possible to access the data without providing the BitLocker recovery key.
- Clearing the key removes the clear key protector from the BitLocker-protected drive, making it necessary to provide the BitLocker recovery key to access the data.
- Erasing the key permanently deletes the BitLocker recovery key, making it impossible to recover the data on the drive.
References
- BitLocker Drive Encryption Step-by-Step Guide: https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-drive-encryption-overview-step-by-step
- BitLocker Drive Encryption: Frequently Asked Questions: https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-drive-encryption-faq