One of the most powerful ways you can protect your data is to encrypt it using a program like BitLocker for Windows 10, which is a proprietary encryption software that operates on the Windows platform.
What Is BitLocker?
BitLocker for Windows 10 is an encryption software available on Windows 10 Pro or Enterprise versions that lets you encrypt your whole hard drive and keep your data safe from prying eyes and unauthorized tampering with your system, such as the kind intrusion that could be committed by malware.
If you, like most people, have the standard, or Home, version of Windows on our PC you won’t have the BitLocker software. However, there was a time when Microsoft initially rolled out their dual interface OS and if you upgraded at that time then you are likely to have either Windows 8 or 8.1 Pro. During the initial roll-out, the Windows 8 Pro upgrade licenses were sold on the cheap, and anyone eligible could get them. If you got the Pro and then moved on from Windows 8.1 to Windows 10, then the upgrade held and BitLocker is probably on your system.
What Are the System Requirements for BitLocker?
To start with, you’ll need a Windows PC and it has to be running any of the eligible versions of Windows. It also needs to have a storage drive with a minimum of 2 partitions and a Trusted Platform Module (TPM).
A TPM is a special kind of computer chip that authenticates your software, firmware, and hardware. It is especially important because if any unauthorized changes to your system are detected by the TPM, then the computer will boot in Restricted mode in order to thwart attackers.
Below are the instructions for both how to check if your computer has the TPM, and also how to run BitLocker without it.
Things to Know Before Setting up BitLocker
Before you start setting up BitLocker on your computer, these are some requirements for using BitLocker.
BitLocker is, for the most part, only available on the Pro and Enterprise versions of Windows, including Windows 10 Pro and Enterprise. For the best results, you need to have a TPM chip on your computer. You may be able to use BitLocker without TPM but it will require extra steps. Your hard drive needs at least 2 partitions to run BitLocker. There needs to be a system partition with the operating system, and another partition with all the required files to start Windows. If you don’t have these partitions, don’t worry, BitLocker will create them for you. The partitions should also follow the NTFS file system. Depending on the amount of data in your system, encryption could take a pretty long time, so brace yourself. Your computer should always be connected to a power supply throughout the encryption process. Make sure you fully back up your system before encrypting it with BitLocker. While BitLocker is stable, there will always be risks, especially if you do not have an uninterruptible power supply and run out of power during the encryption process. You can never be too safe; back up your system.
How to Check for the TPM Chip
Because BitLocker requires the TPM chip for authentication, you’ll need to check that you have one before before getting started. To do that, start by going to the Power User menu. You can access this by pressing the Windows key and X on your keyboard. Once on the Power User menu, click Device Manager.
In the Device Manager, look for the Security Devices item. If you have the TMP chip, you should see an item for Trusted Platform Module along with the version number. For your computer to support BitLocker, the TPM version number should be 1.2 or higher.
How to Turn on BitLocker Without the TPM
If you don’t have a TPM, you will be unable to switch BitLocker on. You’ll still be able to use encryption, but you’ll need to enable additional startup authentication via the Local Group Policy Editor.
Open the Run command. You can do this by pressing the Windows key + R on your keyboard. Once the Run command is on, type gpedit. msc in the field and click OK or press Enter. In the command result, look for an item labeled Computer Configuration. Expand it and look for the Administrative Templates item. Expand that one as well. Under the expanded Administrative Templates, expand the Windows Components item. Under the expanded Windows Components template you will find the BitLocker Drive Encryption item. Expand it and then expand the Operating System Drives item that appears beneath it. Its items will be displayed on the right side. On the right side of the window, right-click the item that reads Require additional authentication at startup, and choose Edit from the menu that appears. In the window that appears, select the Enabled option. Check the checkbox that reads Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive). Once you’re done, complete the process by clicking OK.
How to Run BitLocker
After you’ve enabled the TPM chip, running BitLocker requires just a few steps.
Go to the Power User menu by pressing the Windows key + X on your keyboard. Once there select the Control Panel item. Select System and Security. Click BitLocker Drive Encryption. In the dialog box that opens click Turn on BitLocker. Next, choose Enter a password, and choose a password you would like to use whenever you boot your Windows 10 system to unlock the system drive. Make sure it is a strong password. Once you’re done, click on Next. You will be given options to save a recovery key which you will use to salvage your files in the event that you forget your password. The available options should be to Save to your Microsoft account, a USB flash drive, a file, or print the recovery key. Select whichever is convenient for you. Once you’re done, click Next. Now you need to select an encryption option that suits you. If you have a new PC or drive or want the faster option, encrypt the used disk space. If your PC or drive has already been in use for some time and you don’t mind a slower process, then encrypt the entire disk space. Choose an encryption mode. You can either go for the new encryption mode, which is best for drives that are fixed to this device, or the compatible mode, which is best for removable drives. Once you’re done, click Next. Check the checkbox labeled Run BitLocker system check and then click Continue. You will be required to restart your computer to begin encryption. Upon rebooting, you will be prompted by BitLocker to enter an encryption password to unlock your main drive. Enter the password you chose earlier and press the Enter key. Your computer will boot the Windows desktop. Nothing will seem different, however, encryption should quietly be happening in the background. If you want to verify that this is, in fact, happening, simply go to Control Panel > System and Security > BitLocker > Drive Encryption. There you will see that BitLocker is working to encrypt your files. Depending on how large your drive is and which options you selected, the process can take quite a while. You will still be able to use your computer normally, though. Once everything is finished, the Drive Encryption should show that BitLocker is on.
Additional Tips for Using BitLocker
Once you’ve enabled BitLocker, there are a few more things you can do.
You could suspend protection so your data is not protected. This is best when upgrading hardware, firmware, or operating system. BitLocker will then resume when you reboot. You can also back up your recovery key. This is especially important when you lose your recovery key but are still signed into your account. BitLocker will create a new backup key for you. You can also change your password. You will, however, need the current password to do this. You can also remove your password. However, you will need to configure a new method of authentication since you can’t run BitLocker without any authentication (that would defeat the purpose of the whole thing). You can also turn off BitLocker if you don’t need BitLocker anymore. BitLocker will decrypt all of your files. The decryption process may take a long time (you’ll still be able to work normally on your computer) and your data won’t be protected anymore.
