1

Say I have a machine running Windows 10 with built in Device Encryption enabled. Say I want to reinstall Windows and sell the machine. I am wondering: after the format and reinstall, is a new key generated for the Device Encryption? Or in other words, without having access to the original recovery key, is it remotely possible for the new owner to recover my old files which were encrypted using the original key?

What if I delete a file, turn off Device Encryption, and reenable? Can my deleted file be recovered without the original recovery key?

0

"Device Encryption" in Windows is a user-friendly name for Microsoft's "BitLocker Drive Encryption", first introduced with Windows Vista and updated with newer Windows releases.

I am wondering: after the format and reinstall, is a new key generated for the Device Encryption?

Yes

When BitLocker is "turned on" (enabled), it generates a new encryption key from the system's cryptographically secure pseudo-random number generator (CSPRNG), which is software that takes a large number of of different inputs, including many transient ones that are not practically controllable or repeatable, and mixes them together constantly such that at any time its output will appear totally random. The output of a CSPRNG should not ever predictably repeat, and certainly won't just because you performed a full reinstallation of the OS!

What if I delete a file, turn off Device Encryption, and reenable? Can my deleted file be recovered without the original recovery key?

I don't know, but it may depend on BitLocker mode

There's two points of consideration here: is the old key gone, and did the deleted file get decrypted-and-re-encrypted?

When BitLocker is turned off (or paused), a key is written to the disk in plain text that can be used to recover the master encryption key. This plain-text key will remain until BitLocker is fully done decrypting the drive (if turned off), or is resumed (if paused), at which point the OS attempts to securely wipe that plain-text key from the storage. If an attacker steals the machine before BitLocker is done decrypting, they'll be able to read the still-encrypted data by using that key. I don't know what happens if you turn off BitLocker and then try to turn it on again without giving the OS time to decrypt the disk first; it might just start re-encrypting with the same master key, but set up new "Key Protectors" (the ways, such as boot-time passwords or recovery keys, that the master key can be retrieved to unlock a BitLocker'd volume). That would not be ideal from a security perspective, but with TPM-only mode (I believe most cases where you see BitLocker as "Device Encryption" will be BitLocker in TPM-only mode) there's no user-facing protectors to rotate so it's possible they don't bother rotating the key either. Certainly that would be faster than fully decrypting and re-encrypting with a new key.

However, if you allow the system to fully decrypt before turning BitLocker on again, it will generate a new key. The old one won't be available anywhere for re-use.

For deleted files in particular, this is an interesting question because BitLocker can operate in two modes, and I don't know which one you'd be seeing. The fastest way to encrypt a disk, used by default on new installs, is to encrypt only the in-use space. BitLocker can optionally encrypt all space instead, which takes longer but means previously-deleted data will not be recoverable without the key. Also, BitLocker does not automatically decrypt files upon deletion no matter the mode; that would obviously be insecure. Your question, however, concerns an interesting edge case: if you have BitLocker enabled only and delete a file, and then turn off BitLocker, does it bother to decrypt the free space? I don't know. If it does, then YES, your deleted file would be recoverable (assuming no overwriting, of course) without the old key; either it would still be sitting around in plain text (if you turned BitLocker on again in "used space only" mode) or it would be re-encrypted with the new key (if turned on again with free space also encrypted). However, if it doesn't - if BitLocker never bothers to decrypt "free" space when turning off - then the deleted file's data would be permanently unrecoverable as soon as BitLocker finished decrypting and wiped the old key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.