{"id":8497,"date":"2024-12-09T21:00:07","date_gmt":"2024-12-09T21:00:07","guid":{"rendered":"https:\/\/www.auslogics.com\/en\/articles\/?p=8497"},"modified":"2025-09-02T23:43:24","modified_gmt":"2025-09-02T23:43:24","slug":"protect-bitlocker-encrypted-documents","status":"publish","type":"post","link":"https:\/\/www.auslogics.com\/en\/articles\/protect-bitlocker-encrypted-documents\/","title":{"rendered":"[Complete Guide] How to Enable and Use BitLocker Drive Encryption on Windows 10\/11"},"content":{"rendered":"

Protecting your data has become more crucial than ever, especially in the AI era we are in. Lucky for us, Microsoft has made it easier by automatically enabling BitLocker Drive Encryptio n on PCs (at least for most of the modern ones).<\/p>\n

So you don\u2019t have to go through complex security settings to secure your personal data. All you have to do is sign in to your Microsoft account.\u00a0 But what exactly is Windows BitLocke r? How does it work, and is it any good?<\/p>\n

Do you really need it, or should you stick with third-party tools? I\u2019ll answer these questions and walk you through simple ways to enable the feature.<\/p>\n

What Is BitLocker Drive Encryption?<\/h2>\n

BitLocker is Microsoft\u2019s storage encryption technology on Windows PCs designed to secure your data by encoding it. So, if you enable BitLocker on your primary drive (which is usually labeled C:), every piece of data on it will get encrypted.<\/p>\n

You can also use the BitLocker encryption to encrypt other drives, like external hard drives. If someone gains unauthorized access to your computer, they won\u2019t get access to your data without the encryption key or password.<\/p>\n

Is Windows Device Encryption different from BitLocker?<\/h2>\n

Most people confuse Device Encryption with BitLocker, thinking they are the same. Well, they are not, even though they basically perform the same function. And they are all from Microsoft.<\/p>\n

Later, I\u2019ll compare various Windows encryption tools with BitLocker, including Device Encryption, to give you more clarity. But what you need to know now is that Device Encryption automatically encrypts your hard drive, and it\u2019s done by default.<\/p>\n

This makes it faster, but it\u2019s not as customizable as BitLocker. Here\u2019s a table comparison between the two:<\/p>\n

\n\n\n\n\n\n\n\n\n\n
Feature<\/strong><\/th>\nWindows Device Encryption<\/strong><\/th>\nBitLocker<\/strong><\/th>\n<\/tr>\n
Availability <\/strong><\/td>\nWindows Home and Pro (if hardware supports it)<\/td>\nWindows Pro, Enterprise, and Education only<\/td>\n<\/tr>\n
Encryption coverage<\/strong><\/td>\n\n
    \n
  • Encrypts only primary drive<\/li>\n
  • Encrypts all drives together<\/li>\n<\/ul>\n<\/td>\n
Locks specific or removable drives, entire disk, partitions<\/td>\n<\/tr>\n
Customization<\/strong><\/td>\nCan\u2019t encrypt specific drives or partitions<\/td>\nHighly customizable<\/td>\n<\/tr>\n
Speed<\/strong><\/td>\nGenerally faster than BitLocker<\/td>\nSlower because of its broader feature set<\/td>\n<\/tr>\n
Hardware requirements<\/strong><\/td>\nTPM (1.2 or 2.0), UEFI Secure Boot, DMA protection enabled<\/td>\nTPM (1.2 or later), TCG-compliant BIOS or UEFI<\/td>\n<\/tr>\n
Use case<\/strong><\/td>\nBasic data security for personal devices<\/td>\nAdvanced encryption for enterprises and professional users<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

How Does BitLocker Work?<\/h2>\n

Here\u2019s how BitLocker on Windows 10 or 11 essentially works:<\/p>\n

How the encryption works<\/h3>\n

BitLocker uses the Advanced Encryption Standard (AES), which is either in 128-bit or 256-bit keys. When you activate BitLocker, it encrypts each bit of data on your hard drive.<\/p>\n

In other words, instead of encoding files one by one, it encrypts the entire volume to make sure your data is more secure.<\/p>\n

After that, the encryption key is stored securely, using mostly the Trusted Platform Module (TPM) <\/a> chip. By the way, this chip is a security hardware component in many modern PCs used for generating, storing, and managing cryptographic keys.<\/p>\n

\r\n\t
Note<\/div>\r\n\t
For example, you will not be able to run Windows 11 <\/a> if your PC doesn\u2019t support the TPM technology. <\/div>\r\n<\/div>\n

If your computer doesn\u2019t have a TPM chip, you can change the settings to store the key on a USB drive or use a password or PIN.<\/p>\n

\r\n\t
<\/p>\n

An encryption key is basically a string of characters that transforms plain text into an unreadable format and vice versa. BitLcoker creates it by generating a Full Volume Encryption Key (FVEK) and a volume master key (VMK).<\/p>\n

The FVEK locks the actual data while the VMK encrypts the FVEK. Then, both keys are stored in either the TPM, USB drive, or password, depending on the settings you use. <\/div>\r\n<\/div>\n

How decryption happens during startup<\/h3>\n

BitLocker decryption happens very early in the boot process when you turn on your computer. It begins when the BIOS <\/a> hands over control to the OS loader. If you encrypted your primary drive, the decryption starts right after the PC starts.<\/p>\n

BitLocker first checks to see if any tampering has occurred since the last shutdown by comparing the system\u2019s stored values with the current boot sequence.<\/p>\n

If everything checks out, BitLocker will unlock the VMK, and the VMK will then decrypt the FVEK.<\/p>\n

From there on, the operating system decodes data on the fly as other apps and OS access it. In other words, the decryption happens in real time.<\/p>\n

\r\n\t
<\/p>\n

You might be thinking that if the decryption occurs in real time, then it consumes too many resources, and that can affect system performance. But that\u2019s not the case. You see, the entire process is optimized to have minimal impact on your PC performance.<\/p>\n

And most current CPUs are designed to handle these types of decryptions efficiently so that the process doesn\u2019t cause noticeable delays. <\/div>\r\n<\/div>\n

Different BitLocker authentication options for unlocking your drive:<\/b><\/p>\n

\n
\n\n\n\n\n\n\n
TPM-only mode<\/b><\/td>\nThis mode automatically unlocks the drive without you needing to enter any password or PIN or doing anything at all.<\/td>\n<\/tr>\n
TPM + PIN<\/b><\/td>\nYou have to enter your PIN to get access. It adds an extra layer of security.<\/td>\n<\/tr>\n
TPM + USB key<\/b><\/td>\nYou must insert a USB with the decryption key at startup to log in.<\/td>\n<\/tr>\n
TPM + PIN + USB key<\/b><\/td>\nYou must enter a PIN and insert a USB key to gain access. This offers the highest level of protection.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

How data stays protected<\/h3>\n

I\u2019ve already mentioned how Windows 10 or 11 BitLocker decrypts data as you access files. Let\u2019s go a bit more in detail. The unlocked data is stored in memory at the moment you need it.<\/p>\n

That means when the system shuts down or loses power, the data on the hard drive is still encrypted and thus protected. When you add new data or information, BitLocker encrypts it before it\u2019s saved on the drive.<\/p>\n

Again, the entire process happens in real time and doesn\u2019t affect how your system performs. So you should have no problem.<\/p>\n

How to get back in if locked out<\/h3>\n

Sometimes, Windows BitLocker may fail to start, for example, due to hardware changes or corrupted TPM. When this happens, you\u2019ll be prompted with a 48-digit recovery key, which you should have when setting up BitLocker on Windows 10 or 11.<\/p>\n

\n

\ud83d\udccc Related read: <\/b>BitLocker Recovery Key: How to Avoid Losing It and What to Do if You Do <\/a><\/p>\n

\n

Windows BitLocker System Requirements for Windows 10 and 11<\/h2>\n

BitLocker has a few system requirements that are slightly different between Windows 10 and 11. Let\u2019s quickly go through them:<\/p>\n