Setting up BitLocker to secure your hard drives from theft

1. Introduction: Why Encrypt Your Hard Drives?

What is BitLocker?

BitLocker is a full-disk encryption feature built into Microsoft Windows. It scrambles all data on a storage volume—including your operating system files, personal documents, and temporary files—using mathematical algorithms (such as AES). Without the proper decryption key, password, or PIN, the data appears as unreadable gibberish.

BitLocker typically works alongside a hardware component on your motherboard called a Trusted Platform Module (TPM), which acts as a secure hardware vault for your encryption keys.

Why is BitLocker Important?

Mitigates Data Breaches: It protects sensitive information (like financial records, passwords, or client data) from falling into the wrong hands if a device is physically compromised.
Regulatory Compliance: It helps businesses and organizations meet legal and industry standards for data security, such as GDPR or HIPAA.
Safe Disposal: It ensures that when you recycle, sell, or throw away an old computer or drive, nobody can plug it into another machine and recover your old files.

How encryption protects data if a drive is lost, stolen, or removed from your computer.

Do you keep important financial information (Credit card numbers, pictures of your state ID or your drivers license? Wedding photos? Birth certificate scanned images?). If someone was to steal your Hard drive from your computer, they wouldn’t be able to bypass BitLocker’s encryption to reveal those files as they are revealed to you on your Windows desktop when you have access with your security password.

The difference between encrypting a drive and simply password-protecting individual files.

BitLocker is an overall, highly secure encryption for the ENTIRE DRIVE, whereas password protecting individual files means a single file has an encryption set to it’s base layer. Essentially, everything including things as simple as .lnk shortcut links are UNAVAILBLE to anyone else but you, not just an important file, EVERYTHING.

2. Windows Requirements and Compatibility

Windows edition

Windows 11 Pro
Yes

Windows 11 Enterprise
Yes

Windows 11 Education
Yes

Windows 10 Pro
Yes

Windows 10 Enterprise
Yes

Windows 10 Education
Yes

Windows Home
No full BitLocker management interface; some devices support Device Encryption

3. How to Identify Your Hard Drives Before Encryption

First things first, you must learn to recognize your hard drives based on size, letter, and file system. To do so, 

Open Disk Management:

Win + X → Disk Management

In WIndows disk management you can see how each hard drive has a:

• Disk number.

• Drive letter.

• Drive capacity.

• Partition layout.

• File system.

• Whether the drive is internal or removable.

You can also open Start -> Run or WINDOWS + R and type: PowerShell and open WIndows Powershell.

PowerShell commands:

Get-Volume |
Format-Table DriveLetter, FileSystemLabel, FileSystem, DriveType, Size, SizeRemaining -AutoSize

Show physical disks:

Get-Disk |
Format-Table Number, FriendlyName, SerialNumber, Size, OperationalStatus

Show partitions:

Get-Partition

Readers must verify the drive letter of the physical disks they are going to encrypt with Bitlocker. Never continue to encrypt a hard drive that you are unsure of what it’s function is on your computer.

4. Understanding BitLocker Encryption Status Before Starting

There are multiple PowerShell commands to note for how to identify disks that are actively encrypted or not yet encrypted.

PowerShell:

Get-BitLockerVolume

For more detailed output:

Get-BitLockerVolume | Format-List *

Command Prompt (Run as Administrator):

manage-bde -status

For an individual drive:

manage-bde -status D:

There are important status names for each situation:

There is also a difference between encryption status and protection status. A volume may be fully encrypted while protection is temporarily suspended.

5. Understanding and Saving Your BitLocker Recovery Key

Add-BitLockerKeyProtector -MountPoint "D:" -RecoveryPasswordProtector

(Get-BitLockerVolume -MountPoint "D:").KeyProtector |
Where-Object KeyProtectorType -eq 'RecoveryPassword' |
Format-List KeyProtectorId, RecoveryPassword

manage-bde -protectors -get D:

$SecureString = Read-Host "Enter BitLocker password" -AsSecureString

Enable-BitLocker `
    -MountPoint "D:" `
    -EncryptionMethod XtsAes256 `
    -UsedSpaceOnly `
    -PasswordProtector `
    -Password $SecureString

Add-BitLockerKeyProtector `
    -MountPoint "D:" `
    -RecoveryPasswordProtector

manage-bde -protectors -add -pw D:

manage-bde -protectors -add -recoverypassword D:

manage-bde -on D:

manage-bde -status D:

11. Automatically Unlocking Internal and External Data Drives

When turning on your computer, TPM is a internal motherboard saving mechanism that will automatically unlock your encrypted BitLocker hard drives with the security key that are PHYSICALLY CONNECTED to your computer. This means any time someone takes a hard drive away from your VERY SAME COMPUTER / MOBO, the BitLocker password entree will spawn and they will not be able to automatically unlock the drive as you can on your system.

For example, an internal secondary storage drive can automatically unlock when Windows starts, instead of asking for a password every time.

PowerShell:

Enable-BitLockerAutoUnlock -MountPoint "D:"

Disable it:

Disable-BitLockerAutoUnlock -MountPoint "D:"

CMD:

manage-bde -autounlock -enable D:

And:

manage-bde -autounlock -disable D:

This allows you to not have to spend 10 minutes starting up your computer and instead only really need the BitLocker encryption if theft actually happens. I highly recommend using TPM for your BitLocker setup.

12. Monitoring Encryption Progress

This is an especially useful section for readers with large-capacity HDDs. For example, my 22 TB external HDD took 24 hours to encrypt. It was full of probably 12 TB worth of data.

BitLocker will begin encrypting your drive in the background, it uses minimal CPU and RAM requirements, so you can run it all the time. If your power fails, or you restart your computer, Windows will automatically pick up where you left off on the next restart. Windows captures the current state of your encryption (or decryption) status and continues effortlessly.

PowerShell:

Get-BitLockerVolume -MountPoint "D:" |
Format-List MountPoint, VolumeStatus, EncryptionPercentage, EncryptionMethod, ProtectionStatus

CMD:

manage-bde -status D:

• Conversion Status

• Percentage Encrypted

• Encryption Method

• Protection Status

• Lock Status

SSD’s are faster to encrypt because they are extremely fast drives, whereas oldschool disk drives take longer and usually are larger in size, therefore adding to the time it takes to manage BitLocker status on them.

13. Suspending BitLocker vs. Turning BitLocker Off

This is an important distinction that deserves its own section.

There are multiple variations of pausing or totally removing BitLocker from an encrypted drive:

PowerShell – Suspend:

Suspend-BitLocker -MountPoint "D:"

PowerShell – Resume:

Resume-BitLocker -MountPoint "D:"

CMD – Suspend:

manage-bde -protectors -disable D:

CMD – Resume:

manage-bde -protectors -enable D:

Suspending protection does not decrypt the volume.

14. How to Decrypt a Drive and Turn BitLocker Off

If someone doesn’t want to remove encryption but would like to temporarily suspend the protection status, they can use PowerShell to manipulate the status of BitLocker.

PowerShell:

Disable-BitLocker -MountPoint "D:"

CMD:

manage-bde -off D:

Then monitor decryption:

manage-bde -status D:

Decryption can take a significant amount of time, especially with large HDDs. Do not confuse decryption progress with encryption progress.

15. Unlocking a Drive With the Recovery Password

Show how to recover access if Windows requests a BitLocker recovery password.

CMD:

manage-bde -unlock D: -RecoveryPassword YOUR-48-DIGIT-RECOVERY-PASSWORD

Make sure to print out and save all your recovery passwords and 48 digit recovery keys.

16. Best Practices for Encrypting Large Hard Drives

Here are some best practices for encrypting a large hard drive.

Make sure to run your encryption process while the computer is on, and don’t be afraid to idle the computer on overnight or keep it on all day. A running computer can take little energy resources as long as you aren’t heavily using programs. When you begin encrypting your hard drives, and set up your passwords and reveal your BitLocker encryption codes, remember:

• Always keep an independent backup.

• Save recovery keys outside the drive being encrypted.

• Verify the drive letter before running commands.

• Use full-drive encryption when appropriate for previously used drives.

• Monitor encryption/decryption progress.

• Avoid disconnecting external drives while operations are underway.

• Check hard drive health.

• Keep separate recovery-key records for separate disks.

• Consider performance and encryption duration with large-capacity HDDs.

18. Frequently Asked Questions

1. Does BitLocker erase existing files?

   No

2. Can I encrypt a hard drive without formatting it?

   Yes

3. Can I encrypt a 10 TB or 20 TB external hard drive?

   Yes

4. Does BitLocker slow down a hard drive?

   Very little, less than 1% of it’s non-encrypted speed.

5. Can I move an encrypted drive to another computer?

   Yes, with your security key.

6. What happens if I lose my recovery key?

   If you lose your BitLocker recovery key, you could permanently lose access to the data on your encrypted drive if you also forget your password or cannot otherwise unlock it.

   BitLocker is designed so that Microsoft, Windows, and even the computer manufacturer cannot simply bypass encryption and recover your files.

7. Can I pause BitLocker encryption?

   Yes.

   manage-bde -pause driveletter:

8. Can I use BitLocker on an external USB HDD?

   Yes.

9. How do I know if a drive is fully encrypted?

   The BitLocker Windows GUI will confirm and also you can tell with PowerShell / CMD with:

   manage-bde -status driveletter:

10. What’s the difference between encryption and protection status?

    Encryption means the encryption process has been complete, whereas protection status can mean you can temporarily disable protection for a short period (or long period) of time.

19. Conclusion

Having your computer safe and your important files backed up is important for a lot of people. Thankfully, BitLocker makes security easy, and I hope this guide has been assisting you on all the necessary information and steps it takes to complete your BitLocker encryption goals for your hard drives. I personally have ever single hard drive encrypted on my home system, and I have printed and put in a safe all my recovery keys and backup needs.

About the author:

My name is Ryan Bassett and I’m a web designer and developer out of Canoga Park. I offer Canoga Park Web Design services and have been an avid PC user for the last 30 years.