{"id":21,"date":"2026-11-08T19:36:05","date_gmt":"2026-11-08T19:36:05","guid":{"rendered":"https:\/\/bassettgraphics.com\/blog\/?p=21"},"modified":"2026-11-08T19:57:30","modified_gmt":"2026-11-08T19:57:30","slug":"setting-up-bitlocker-to-secure-your-hard-drives-from-theft","status":"publish","type":"post","link":"https:\/\/bassettgraphics.com\/blog\/2026\/11\/08\/setting-up-bitlocker-to-secure-your-hard-drives-from-theft\/","title":{"rendered":"Setting up BitLocker to secure your hard drives from theft"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

1. Introduction: Why Encrypt Your Hard Drives?<\/h3>\n

<\/p>\n

<\/p>\n

What is BitLocker?<\/p>\n

BitLocker<\/strong> is a full-disk encryption feature built into Microsoft Windows<\/mark>. It scrambles all data on a storage volume\u2014including your operating system files, personal documents, and temporary files\u2014using mathematical algorithms (such as AES). Without the proper decryption key, password, or PIN, the data appears as unreadable gibberish.<\/p>\n

BitLocker typically works alongside a hardware component on your motherboard called a Trusted Platform Module (TPM)<\/strong>, which acts as a secure hardware vault for your encryption keys.<\/p>\n

<\/p>\n

<\/p>\n

Why is BitLocker Important?<\/p>\n

Mitigates Data Breaches:<\/strong> It protects sensitive information (like financial records, passwords, or client data) from falling into the wrong hands if a device is physically compromised.
Regulatory Compliance:<\/strong> It helps businesses and organizations meet legal and industry standards for data security, such as GDPR<\/strong> or HIPAA<\/strong>.
Safe Disposal:<\/strong> It ensures that when you recycle, sell, or throw away an old computer or drive, nobody can plug it into another machine and recover your old files.<\/p>\n

<\/p>\n

<\/p>\n

How encryption protects data if a drive is lost, stolen, or removed from your computer.<\/p>\n

Do you keep important financial information (Credit card numbers, pictures of your state ID or your drivers license? Wedding photos? Birth certificate scanned images?). If someone was to steal your Hard drive from your computer, they wouldn’t be able to bypass BitLocker’s encryption to reveal those files as they are revealed to you on your Windows desktop when you have access with your security password.<\/p>\n

<\/p>\n

<\/p>\n

The difference between encrypting a drive and simply password-protecting individual files.<\/p>\n

BitLocker is an overall, highly secure encryption for the ENTIRE DRIVE, whereas password protecting individual files means a single file has an encryption set to it’s base layer. Essentially, everything including things as simple as .lnk shortcut links are UNAVAILBLE to anyone else but you, not just an important file, EVERYTHING.<\/p>\n

<\/p>\n

<\/p>\n

2. Windows Requirements and Compatibility<\/h3>\n

Windows edition<\/p>\n

Windows 11 Pro
Yes<\/p>\n

Windows 11 Enterprise
Yes<\/p>\n

Windows 11 Education
Yes<\/p>\n

Windows 10 Pro
Yes<\/p>\n

Windows 10 Enterprise
Yes<\/p>\n

Windows 10 Education
Yes<\/p>\n

Windows Home
No full BitLocker management interface; some devices support Device Encryption<\/p>\n

3. How to Identify Your Hard Drives Before Encryption<\/h3>\n

First things first, you must learn to recognize your hard drives based on size, letter, and file system. To do so,\u00a0<\/p>\n

Open Disk Management:<\/p>\n

Win + X \u2192 Disk Management<\/code><\/p>\n

In WIndows disk management you can see how each hard drive has a:<\/p>\n

    \n
  • \n

    Disk number.<\/p>\n<\/li>\n

  • \n

    Drive letter.<\/p>\n<\/li>\n

  • \n

    Drive capacity.<\/p>\n<\/li>\n

  • \n

    Partition layout.<\/p>\n<\/li>\n

  • \n

    File system.<\/p>\n<\/li>\n

  • \n

    Whether the drive is internal or removable.<\/p>\n<\/li>\n<\/ul>\n

    You can also open Start -> Run or WINDOWS + R and type: PowerShell and open WIndows Powershell.<\/p>\n

    PowerShell commands:<\/p>\n

    \n
    Get-Volume |\nFormat-Table DriveLetter, FileSystemLabel, FileSystem, DriveType, Size, SizeRemaining -AutoSize<\/code><\/pre>\n<\/div>\n
    Show physical disks:<\/p>\n
    \n
    Get-Disk |\nFormat-Table Number, FriendlyName, SerialNumber, Size, OperationalStatus<\/code><\/pre>\n<\/div>\n
    Show partitions:<\/p>\n
    \n
    Get-Partition<\/code><\/pre>\n<\/div>\n
    Readers must verify the drive letter of the physical disks they are going to encrypt with Bitlocker. Never continue to encrypt a hard drive that you are unsure of what it’s function is on your computer.<\/p>\n
    4. Understanding BitLocker Encryption Status Before Starting<\/h3>\n
    There are multiple PowerShell commands to note for how to identify disks that are actively encrypted or not yet encrypted.<\/p>\n
    PowerShell:<\/p>\n
    \n
    Get-BitLockerVolume<\/code><\/pre>\n<\/div>\n
    For more detailed output:<\/p>\n
    \n
    Get-BitLockerVolume | Format-List *<\/code><\/pre>\n<\/div>\n
    Command Prompt (Run as Administrator):<\/p>\n
    \n
    manage-bde -status<\/code><\/pre>\n<\/div>\n
    For an individual drive:<\/p>\n
    \n
    manage-bde -status D:<\/code><\/pre>\n<\/div>\n
    There are important status names for each situation:<\/p>\n\n\n\n\n\n\n\n\n\n
    \n
    Status<\/p>\n<\/th>\n
    		\n
    Meaning<\/p>\n<\/th>\n<\/tr>\n
    \n
    FullyDecrypted<\/p>\n<\/td>\n
    		\n
    No encryption currently applied<\/p>\n<\/td>\n<\/tr>\n
    \n
    EncryptionInProgress<\/p>\n<\/td>\n
    		\n
    Drive is being encrypted<\/p>\n<\/td>\n<\/tr>\n
    \n
    FullyEncrypted<\/p>\n<\/td>\n
    		\n
    Encryption has completed<\/p>\n<\/td>\n<\/tr>\n
    \n
    DecryptionInProgress<\/p>\n<\/td>\n
    		\n
    Drive is being decrypted<\/p>\n<\/td>\n<\/tr>\n
    \n
    EncryptionPaused<\/p>\n<\/td>\n
    		\n
    Encryption has been paused<\/p>\n<\/td>\n<\/tr>\n
    \n
    ProtectionStatus: On<\/p>\n<\/td>\n
    		\n
    BitLocker protection is active<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
    There is also a difference between encryption status and protection status. A volume may be fully encrypted while protection is temporarily suspended.<\/p>\n
    5. Understanding and Saving Your BitLocker Recovery Key<\/h3>\n
    \n
    \u00a0GUI instructions:<\/div>\n
      \n
    1. \n
      Open Manage BitLocker.<\/p>\n<\/li>\n
    2. \n
      Expand the selected drive.<\/p>\n<\/li>\n
    3. \n
      Select Back up your recovery key.<\/p>\n<\/li>\n
    4. \n
      Choose an available backup destination.<\/p>\n<\/li>\n<\/ol>\n
      There are multiple destinations for saving your encyrption keys. Possible destinations include a Microsoft account (where supported), USB drive, separate file location, or printed copy.<\/p>\n
      \n
      \n
      \u00a0PowerShell commands:<\/p>\n<\/div>\n<\/div>\n
      Add a recovery password protector:<\/p>\n
      \n
      Add-BitLockerKeyProtector -MountPoint \"D:\" -RecoveryPasswordProtector<\/code><\/pre>\n<\/div>\n
      Display the recovery password:<\/p>\n
      \n
      (Get-BitLockerVolume -MountPoint \"D:\").KeyProtector |\nWhere-Object KeyProtectorType -eq 'RecoveryPassword' |\nFormat-List KeyProtectorId, RecoveryPassword<\/code><\/pre>\n<\/div>\n
      Important: This command displays the actual recovery password. Readers should save it securely and never include it in screenshots, public posts, or support requests.<\/p>\n
      Command Prompt alternative:<\/p>\n
      \n
      manage-bde -protectors -get D:<\/code><\/pre>\n<\/div>\n
      With BitLocker, both the Recovery Password and the Recovery Key File allow you to regain access to an encrypted drive if Windows cannot automatically unlock it. However, they are two different types of recovery credentials.<\/p>\n
      The Recovery Password is a unique 48-digit numerical code generated when BitLocker is enabled.<\/p>\n
        \n
      • \n
        Consists of 48 numbers divided into eight groups of six digits.<\/p>\n<\/li>\n
      • \n
        Can be entered manually when Windows asks for BitLocker recovery.<\/p>\n<\/li>\n
      • \n
        Can be saved to your Microsoft account, a USB drive, or printed.<\/p>\n<\/li>\n
      • \n
        Can unlock the encrypted drive when the corresponding recovery protector is available.<\/p>\n<\/li>\n<\/ul>\n
        The Recovery Key File is a file generated by BitLocker, typically with a .BEK<\/code> extension.<\/p>\n
        Unlike the recovery password, you don’t manually type its contents.<\/p>\n
          \n
        • \n
          \n
          \n
          Usually stored on a USB flash drive or another storage location.<\/p>\n<\/div>\n<\/div>\n<\/li>\n
        • \n
          \n
          \n
          Contains cryptographic information used by BitLocker to unlock the drive.<\/p>\n<\/div>\n<\/div>\n<\/li>\n
        • \n
          \n
          \n
          Can be used by Windows to automatically authenticate the recovery key.<\/p>\n<\/div>\n<\/div>\n<\/li>\n
        • \n
          Must correspond to the specific BitLocker recovery protector on the encrypted drive.<\/p>\n<\/li>\n<\/ul>\n
          \n
          Choices for encrypting your hard drive. Full encryption or used disk space only.<\/h4>\n
          Option A: Encrypt used disk space only<\/div>\n
            \n
          • \n
            Encrypts the portions of the drive currently containing data.<\/p>\n<\/li>\n
          • \n
            Generally faster on a new or freshly formatted drive.<\/p>\n<\/li>\n
          • \n
            Does not encrypt previously deleted data residing in unused space.<\/p>\n<\/li>\n<\/ul>\n
            Option B: Encrypt the entire drive<\/p>\n
              \n
            • \n
              Encrypts used and unused space.<\/p>\n<\/li>\n
            • \n
              Takes considerably longer on large HDDs.<\/p>\n<\/li>\n
            • \n
              More appropriate for drives that previously stored sensitive information.<\/p>\n<\/li>\n<\/ul>\n
              Microsoft specifically recommends considering full-drive encryption for drives that already contain data, including data previously stored and subsequently deleted.<\/p>\n
              \n
              \n
              \u00a0Encryption modes:<\/p>\n<\/div>\n<\/div>\n
              \n\n\n\n\n\n
              \n
              Mode<\/p>\n<\/th>\n
              		\n
              Purpose<\/p>\n<\/th>\n<\/tr>\n
              \n
              New encryption mode<\/p>\n<\/td>\n
              		\n
              Modern Windows systems<\/p>\n<\/td>\n<\/tr>\n
              \n
              Compatible mode<\/p>\n<\/td>\n
              		\n
              Drives that may be moved to older Windows systems<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
              6. Encrypting a Drive Using PowerShell Instead of the GUI<\/h3>\n
              PowerShell is useful for users who want repeatable commands or need to manage multiple drives.<\/p>\n
              Example: Encrypting a data drive using a password<\/p>\n
              Run PowerShell as Administrator:<\/p>\n
              \n
              \n
              $SecureString = Read-Host \"Enter BitLocker password\" -AsSecureString\n\nEnable-BitLocker `\n    -MountPoint \"D:\" `\n    -EncryptionMethod XtsAes256 `\n    -UsedSpaceOnly `\n    -PasswordProtector `\n    -Password $SecureString<\/code><\/pre>\n<\/div>\n<\/div>\n
              Then add a recovery password protector:<\/p>\n
              \n
              \n
              Add-BitLockerKeyProtector `\n    -MountPoint \"D:\" `\n    -RecoveryPasswordProtector<\/code><\/pre>\n<\/div>\n<\/div>\n
              Retrieve the recovery key using the command in Section 5 and securely back it up.<\/p>\n
              \n
              \n\n\n\n\n\n\n\n\n
              \n
              Parameter<\/p>\n<\/th>\n
              		\n
              Purpose<\/p>\n<\/th>\n<\/tr>\n
              \n
              -MountPoint<\/code><\/p>\n<\/td>\n
              		\n
              Specifies the drive letter<\/p>\n<\/td>\n<\/tr>\n
              \n
              -EncryptionMethod<\/code><\/p>\n<\/td>\n
              		\n
              Selects the encryption algorithm<\/p>\n<\/td>\n<\/tr>\n
              \n
              -UsedSpaceOnly<\/code><\/p>\n<\/td>\n
              		\n
              Encrypts only currently occupied space<\/p>\n<\/td>\n<\/tr>\n
              \n
              -PasswordProtector<\/code><\/p>\n<\/td>\n
              		\n
              Uses a password to unlock the drive<\/p>\n<\/td>\n<\/tr>\n
              \n
              -Password<\/code><\/p>\n<\/td>\n
              		\n
              Supplies the secure password<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n
              This is an example for a data volume, not the Windows operating system drive. Windows system drives have different protector requirements, generally involving TPM.<\/p>\n<\/div>\n
              10. Using CMD to Enable BitLocker<\/h3>\n
              PowerShell isn’t the only command-line option.<\/p>\n
              The manage-bde<\/code> utility is included with Windows and can control BitLocker.<\/p>\n
              Add a password protector:<\/p>\n
              \n
              \n
              manage-bde -protectors -add -pw D:<\/code><\/pre>\n<\/div>\n<\/div>\n
              Add a recovery password protector:<\/p>\n
              \n
              \n
              manage-bde -protectors -add -recoverypassword D:<\/code><\/pre>\n<\/div>\n<\/div>\n
              Start encrypting the drive:<\/p>\n
              \n
              \n
              manage-bde -on D:<\/code><\/pre>\n<\/div>\n<\/div>\n
              Check encryption status:<\/p>\n
              \n
              \n
              manage-bde -status D:<\/code><\/pre>\n<\/div>\n<\/div>\n
              manage-bde<\/code> has options for encryption, decryption, recovery, locking, unlocking, and managing protectors.<\/p>\n<\/div>\n
              11. Automatically Unlocking Internal and External Data Drives<\/h3>\n
              When turning on your computer, TPM is a internal motherboard saving mechanism that will automatically unlock your encrypted BitLocker hard drives with the security key that are PHYSICALLY CONNECTED to your computer. This means any time someone takes a hard drive away from your VERY SAME COMPUTER \/ MOBO, the BitLocker password entree will spawn and they will not be able to automatically unlock the drive as you can on your system.<\/p>\n
              For example, an internal secondary storage drive can automatically unlock when Windows starts, instead of asking for a password every time.<\/p>\n
              PowerShell:<\/p>\n
              \n
              \n
              Enable-BitLockerAutoUnlock -MountPoint \"D:\"<\/code><\/pre>\n<\/div>\n<\/div>\n
              Disable it:<\/p>\n
              \n
              \n
              Disable-BitLockerAutoUnlock -MountPoint \"D:\"<\/code><\/pre>\n<\/div>\n<\/div>\n
              CMD:<\/p>\n
              \n
              \n
              manage-bde -autounlock -enable D:<\/code><\/pre>\n<\/div>\n<\/div>\n
              And:<\/p>\n
              \n
              \n
              manage-bde -autounlock -disable D:<\/code><\/pre>\n<\/div>\n<\/div>\n
              This allows you to not have to spend 10 minutes starting up your computer and instead only really need the BitLocker encryption if theft actually happens. I highly recommend using TPM for your BitLocker setup.<\/p>\n
              12. Monitoring Encryption Progress<\/h3>\n
              This is an especially useful section for readers with large-capacity HDDs. For example, my 22 TB external HDD took 24 hours to encrypt. It was full of probably 12 TB worth of data.<\/p>\n
              BitLocker will begin encrypting your drive in the background, it uses minimal CPU and RAM requirements, so you can run it all the time. If your power fails, or you restart your computer, Windows will automatically pick up where you left off on the next restart. Windows captures the current state of your encryption (or decryption) status and continues effortlessly.<\/p>\n
              PowerShell:<\/p>\n
              \n
              \n
              Get-BitLockerVolume -MountPoint \"D:\" |\nFormat-List MountPoint, VolumeStatus, EncryptionPercentage, EncryptionMethod, ProtectionStatus<\/code><\/pre>\n<\/div>\n<\/div>\n
              CMD:<\/p>\n
              \n
              \n
              manage-bde -status D:<\/code><\/pre>\n<\/div>\n<\/div>\n