TPM and Bitlocker: fixed data drive automatically unlock - what does it mean?

[mikewinddale]

So I purchased a Lenovo E570 about a month ago, with Windows 10 Home. Yesterday, I upgraded it to Windows 10 Pro so that I could use Bitlocker.

Long story short: I'm having trouble encrypting my secondary fixed data drive. Let me explain in detail:

I've got an M.2 PCIe NVMe boot drive (from the factory) and a retail aftermarket 2.5" SATA SSD I installed myself as a secondary fixed data drive.

When I set up Bitlocker, it does detect my TPM. So I encrypted my boot drive with the TPM as the key protector. So far, so good.

Then I encrypted my fixed data drive. It says it is encrypted. So far, so good.

I can turn off my computer and reboot and access all my data. So far, so good.

The issue is, I'm not sure WHAT is protecting my fixed data drive. It's set to "auto unlock", but I can't figure out what it unlocks in response to. I want to make sure that my fixed data drive is unlocking only in response to something I have, and that no thief has. So great, my secondary fixed data drive is encrypted, but I can't tell what's the key. If the key is something that a thief has, then the encryption is useless. I need to verify that it's a key that only I have.

I can set boot and logon passwords just fine. What I want to do is protect against a thief who steals my physical computer, removes the drives, and mounts them in another computer. So that's where TPM comes in. I want to make sure that my fixed data drive is protected by TPM. I want TPM to be the key for my secondary fixed data drive.

The problem is, I can't figure out whether it is or not. All I know is that it is set to "automatically unlock", but I can't figure out, "in response to what?". What's the trigger that makes it unlock?

I can see how to set a password on the data drive, but I don't want a password. I've got enough passwords to remember as it is. I just want to encrypt it with the TPM to protect against a thief who might physically remove my drive from my computer.

So my only options are password or else "automatically unlock". But I can't tell whether "automatically unlock" uses my TPM or not.

I've called Microsoft technical support, and they didn't know the answer.

I'm attaching a screenshot of "manage-bde -status": http://i.imgur.com/0ZuSbaQ.png

As you can see, the boot drive is protected by TPM and by numerical password (I assume that's the recovery key, because I didn't set a user password).

By contrast, the data drive is protected by a numerical password (again, the recovery key?) and by an external key. But I didn't set up an external key. I don't have an external USB flash recovery key. I created nothing of the sort. So what is automatically unlocking my drive? If my drive automatically unlocks in response to nothing, then what will stop a thief? It will automatically unlock in response to nothing for him too!!!

 

[t53186]

TPM is used for the boot drive, more info available here

https://technet.microsoft.com/en-us/itpro/windows/keep-secure/bitlocker-basic-deployment

 

[mikewinddale]

t53186, thanks.

So that article says, regarding fixed secondary data drives, "The available options are password and smart card and automatically unlock this drive on this computer. Disabled by default, the latter option will unlock the data volume without user input when the operating system volume is unlocked."

So does this mean that the data drive is automatically unlocked when the boot drive is unlocked? So it's basically piggybacking? If I set the boot drive to unlock for any given "X", then whenever "X" is true, the boot drive unlocks, and then the data drive automatically unlocks in response?

So does this mean that if the boot drive is TPM-unlocked, then for all practical purposes, so is my data drive?

What happens if someone steals my data drive, and mounts it in a computer with a different Bitlocker-encrypted boot drive? Then the thief can unlock his own Bitlocker-encrypted boot drive. Will my stolen data drive automatically unlock in response? That is to say, does my data drive automatically unlock in response to ANY boot drive, or only MY boot drive?

Thanks.

 

[t53186]

Your data is fully protected and encrypted. No one can unencrypt the data without the drives installed in the original hardware. That's what TPM is for, it's a hardware encoded key that cannot be changed. So no if a thief got your drive is would be worthless regardless of what system it was installed in.

If you encrypted the second drive with a key it would still be unreadable.

 

[mikewinddale]

Your data is fully protected and encrypted. No one can unencrypt the data without the drives installed in the original hardware. That's what TPM is for, it's a hardware encoded key that cannot be changed. So no if a thief got your drive is would be worthless regardless of what system it was installed in.

If you encrypted the second drive with a key it would still be unreadable.

Thanks. So let me just clarify to be absolutely sure:

When BitLocker says that my data drive is automatically unlocked whenever the BitLocker-protected boot drive is unlocked, this refers specifically to **MY** BitLocker-protected boot drive? And not merely **ANY** BitLocker-protected boot drive?

Because if I literally construe Microsoft's words, then my data drive will unlock whenever the BitLocker-protected boot drive unlocks. So a thief could just set up their own BitLocker-protected boot drive, set to unlock to the thief's TPM and PIN, and then transplant my data drive into their computer. My data drive would see that the thief's boot drive is BitLocker-protected and unlocked, and if I take Microsoft's words literally, my own data drive would unlock in response. Because Microsoft doesn't say that my data drive unlocks in response to MY BitLocker-protected drive specifically. Microsoft seems to imply that all my data drive looks for is **ANY** BitLocker-protected boot drive that is unlocked, even if it's someone else's boot drive. And of course, that's not secure at all!!

It's all well and good that my boot drive is protected by the TPM, but if my data drive merely piggybacks on the boot drive without checking the TPM itself, then it's vitally important that my data drive is piggybacking only on **MY** boot drive and not just any old random boot drive.

But it sounds like in fact, my data drive is unlocking in response to **MY** BitLocker-protected boot drive, and not anyone else's BitLocker-protected boot drive. So even if someone else has a BitLocker-protected boot drive, transplanting my data drive into their computer wouldn't do them any good. Right?

Thanks again.

 

[t53186]

You are correct, if I took your drive and installed it in my computer it would not work, neither of the drives would work. Bitlocker can be used on a USB stick, removable hard drives, flash drives, etc and will only unlock by putting that removable drive back in to the platform that created the bitlocker encryption.

 

[Kevin_269]

Your data drive is being auto-unlocked with a key file contained on the encrypted boot drive. So in essence, the TPM is protecting both drives.

 

[gomerpile]

Your data is fully protected and encrypted. No one can unencrypt the data without the drives installed in the original hardware. That's what TPM is for, it's a hardware encoded key that cannot be changed. So no if a thief got your drive is would be worthless regardless of what system it was installed in.

If you encrypted the second drive with a key it would still be unreadable.

Thanks. So let me just clarify to be absolutely sure:

When BitLocker says that my data drive is automatically unlocked whenever the BitLocker-protected boot drive is unlocked, this refers specifically to **MY** BitLocker-protected boot drive? And not merely **ANY** BitLocker-protected boot drive?

Because if I literally construe Microsoft's words, then my data drive will unlock whenever the BitLocker-protected boot drive unlocks. So a thief could just set up their own BitLocker-protected boot drive, set to unlock to the thief's TPM and PIN, and then transplant my data drive into their computer. My data drive would see that the thief's boot drive is BitLocker-protected and unlocked, and if I take Microsoft's words literally, my own data drive would unlock in response. Because Microsoft doesn't say that my data drive unlocks in response to MY BitLocker-protected drive specifically. Microsoft seems to imply that all my data drive looks for is **ANY** BitLocker-protected boot drive that is unlocked, even if it's someone else's boot drive. And of course, that's not secure at all!!

It's all well and good that my boot drive is protected by the TPM, but if my data drive merely piggybacks on the boot drive without checking the TPM itself, then it's vitally important that my data drive is piggybacking only on **MY** boot drive and not just any old random boot drive.

But it sounds like in fact, my data drive is unlocking in response to **MY** BitLocker-protected boot drive, and not anyone else's BitLocker-protected boot drive. So even if someone else has a BitLocker-protected boot drive, transplanting my data drive into their computer wouldn't do them any good. Right?

Thanks again.

You can go into gpedit.msc and configure bitlocker to require a pin. Gpedit>Administrative Timplates>windows components>BitLocker>Operating system drives> Enable require additional authentication at startup.
Set require a pin,
So now you have locked your drives at bootup, if U dont use tpm you will need a usb to store your keys.
What will happen now, the pin will be in your tpm, when you boot up, the pin is required to unlock the boot process. So if your shut down and someone tries to access the computer good luck, or if the computer is stolen good luck. There is no chance to even get to the users login.
To set pin in admin cmd manage-bde -protectors -add c: -TPM you can now set your pin