10

We want to dispose of an old notebook whose display frame is damaged. It's a Windows device with a BitLocker (TPM+PIN) encrypted SSD.

I am trying to devise a strategy for protecting the data on the drive from recovery that is both simple (no disassembly of the notebook) and reasonably secure (old PINs, recovery keys etc. should no longer work, but I'm not trying to protect the data against three-letter agencies - the data is not that important).

Currently, the following protectors are configured:

C:\Windows\System32>manage-bde C: -protectors -get
BitLocker Drive Encryption: Configuration Tool version 10.0.22621
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Volume C: [Home-Office-Client]
All Key Protectors

    TPM And PIN:
      ID: [redacted]
      PCR Validation Profile:
        7, 11
        (Uses Secure Boot for integrity validation)

    Numerical Password:
      ID: [redacted]
      Password:
        [redacted]

My plan is to do the following:

  1. Remove the "numerical password" protector (which should be the recovery key). Now the drive can no longer be unlocked with the old recovery key.

  2. Change the BitLocker PIN to a new value that is not recorded anywhere. Now the drive can no longer be unlocked with the old PIN.

  3. Do not remove the TPM+PIN protector, because removing all protectors will make the encryption key available unsecured.

  4. (optional) Clear the TPM. Shouldn't be necessary, since both TPM+PIN are required, but it's easy to do and provides an additional layer of protection in case I messed up step 2.

  5. Dispose of the device.

Any flaws in my plan? Any simpler way to achieve my goal?

Improve this question
7
  • 2
    That is in broad strokes what we came up with for remote wipes when replacing Absolute. I believe we also added some registry values to ensure BitLocker would work, wasn't suspended, alphanumeric PIN, log off users/restart, etc.
    – Greg Askew
    Commented Oct 31 at 15:51
  • 1
    I usually use Linux for this kind of thing, but I vaguely remember something about DiskTrim on Windows being able to send whole-drive erase commands on Windows. Depending on how the drive internals are arranged this might not keep the NSA from reading your discarded data, but it does, at a minimum put it into the realm of needing to disassemble the drive and analyze the raw flash chips to get any of it back. Assuming it actually works anyway. I'm not in a position to test it.
    – Perkins
    Commented Nov 1 at 17:43
  • 1
    Honest follow-up to this: at what point does "remove the drive & hammer a couple of large nails through it" become less time & (at least) equally effective for making the data unrecoverable?
    – Ralph J
    Commented Nov 3 at 4:31
  • @RalphJ: When I was young, removing a HDD from a notebook could be done in a few seconds with a household screwdriver. Nowadays, you have to disassemble the whole device with special tools to get to the SSD.
    – Heinzi
    Commented Nov 3 at 7:58
  • 1
    @Heinzi Are you sure that is the case for this particular device? All of my (business-class) laptops I used in the last 10+ years would let you access the SSD after removing at most the bottom cover (which might involve a dozen screws, but nothing particularly special).
    – TooTea
    Commented Nov 3 at 10:51

3 Answers 3

Reset to default
14

According to Microsoft, you just need to use the format command, through a recovery environment.

The Format command has been modified in Windows Vista so that it is BitLocker-aware. If a PC that is protected by BitLocker is formatted, then Format also specifically destroys the key data -- providing a much more secure data deletion method.

That should be sufficient if the SSD is not tampered with (via hardware or firmware). Following up with a SSD crypto erase (if available) would add protection on top of that.

Consider that removing the numerical key protector can only be done by overwriting it on the disk, so if you have the means to do so, you might as well overwrite the full volume encryption key.

Improve this answer
1
  • 2
    I tried this method and format outputs the following message: BitLocker encryption and the encrypted data on the volume has been removed. So, yes, I can confirm that this works.
    – Heinzi
    Commented Nov 4 at 10:25
8

Rather than faffing around with BitLocker, why not just boot a Linux distro from a USB device and wipe the drive with an NVME/ATA erase?

Improve this answer
7
  • 3
    Or alternatively, I'd recommend installing a tool dedicated to this specific chore onto bootable media. (Something like DBAN.)
    – security_paranoid
    Commented Nov 1 at 0:32
  • 1
    even dd, but not /dev/urandom as that is just mean.
    – mckenzm
    Commented Nov 1 at 0:57
  • 2
    @security_paranoid does DBAN support NVMe/ATA erase? Last time I used it (many years ago) it was just various different overwrite methods.
    – Gh0stFish
    Commented Nov 1 at 10:02
  • 1
    @mckenzm dd may not be a safe choice for that. Plain cat is generally faster and safer. dd has its nice uses, but this ain't it.
    – marcelm
    Commented Nov 1 at 12:57
  • 2
    @mckenzm No, I'm talking about doing something like cat /dev/zero > /dev/sda. dd has no advantages here, and only downsides.
    – marcelm
    Commented Nov 2 at 12:55
3

(This is a self-answer, as a warning for posterity.)

I tried the method presented in the question, and it did not work. I used the following sequence of commands:

manage-bde C: -protectors -delete -type recoverypassword
manage-bde C: -changepin
powershell
Clear-Tpm

After rebooting, the data on the drive was available and unlocked (BitLocker suspended). I suspect that somewhere along the way Windows detected that I was about to lock myself out (which was my intention) and helpfully disabled BitLocker. Go figure!

It might be possible to fine-tune to process to avoid this, but, as the other answers show, there are less complex (and less error-prone) alternatives, so it's probably not worth the effort.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .