At what point is a Bitlocker drive unlocked and how does additional pre boot pin add to security?

Question

If I enable Bitlocker on a regular Windows 10 machine, how does the unlocking process work? I presume I put in my Windows password and at that point it starts the unlock process. Why is there an additional pre boot option and how does this add to security?

Answer 1

No, thats not how BitLocker works. BitLocker has an additional partition thats stores information about the encryption/decryption process together with some metadata. It holds the cipher used, block mode, keysize, number of used slots and authentication method (amongst other things).

With enough information from this partition the decryption process can begin. The user is asked for his passphrase or private key file (in case of USB) and can decrypt the modules, driver and bootstrap executables in order to load the kernel.

The disk is not decrypted at boot, but instead Windows makes use of an additional IO layer. This layer hooks between the file system driver and the disk driver and decrypts the information on retrieval (and encrypts on write). As long as the operating systems runs, the secret is stored in protected (kernel) memory. Therefore it is important you shutdown the computer gracefully and give Windows the time to nullify the memory. The same is true for other systems.

Answer 2

I don't like @Yorick's answer. This assertion:

The disk is not decrypted at boot, but instead Windows makes use of an additional IO layer

Is misleading^*. Once the encrypted volume is mounted the contents are transparently accessible to software running on the device as if it weren't encrypted at all.

FDE protects against offline data theft. Once the volume is mounted it's effectively decrypted and beyond FDE protection.

Regarding OP's follow up question about pre-boot pin:

Bitlocker has 5 different ways of operation:

The least secure is TPM only, where the TPM is used to unlock the drive on boot without additional intervention. This protects the data in case the drive is removed from the device, since it can't be unlocked without the device's TPM. It doesn't protect the drive if the whole device is stole or otherwise accessed by an attacker.

The TPM+PIN mode, which is what the question referred to, adds a pin to the process, so in order for the TPM to be used to unlock the drive the user must input a pin. This protects against device theft as well, adding more security to the previous mode. The trade off is that it requires physical presence at boot. Not a problem for laptops usually, big problem for servers.

Then there's password, smartcard and usb thumb drive containing unlock key (this last one useful when there's no tpm on the device). Some combinations of the different methods are allowed as well.

_{* I'm not saying the answer is wrong, but that assertion is misleading and unnecessarily confuses begginers}