Figure 15-8 You must first enable BitLocker on the System drive, after which you can encrypt the in Software

Creator Code39 in Software Figure 15-8 You must first enable BitLocker on the System drive, after which you can encrypt the

15:

that at a minimum you store it on a USB key and on a hard drive rather than storing any on the computer you are encrypting (because if the computer is stolen, the thief has the key) Click an option and then repeat to save or print the key as many times as you wish

9 Click Next You are told that the encryption is about to start and given the option to run a system check to see if the keys you have stored are all available It is strongly recommended that you do the check Click Continue 10 Make sure the USB key is plugged in and click Restart Now After restarting, you should see a balloon message from a system tray icon saying the BitLocker Drive Encryption Is xx% Complete If you reopen the BitLocker control panel, you ll see that the drive encryption is in process

Using a computer with BitLocker is not much different than using one without it, except that unless you have TPM, you must plug in the USB key before starting the computer There are several logistical issues to keep in mind: If you create, copy, or move a file on or to a BitLocker drive or volume, it will be automatically encrypted, but will remain so only on that drive Given that the system is started with the USB key, a PIN, or TPM, the file will be available in the same way it was before installing BitLocker If you copy or move a file from the BitLocker drive or volume to another unencrypted drive, the file will automatically be unencrypted on the second drive If you share files on the BitLocker drive, other users with appropriate permission will be able to see and use the files as they could on a non-BitLocker drive The files will remain encrypted on the BitLocker drive, but the user will be able, with the correct permission, to copy the file to an unencrypted drive where the file will be unencrypted If the computer you are working on has TPM and you have installed BitLocker, when it starts up, it looks for any condition that might represent that someone has been trying to hack into it This might be changes to the startup files, disk errors, or changes to the Basic Input/Output System (BIOS) When TPM with BitLocker sees any of these conditions, it will lock the system and prevent it from starting The same items that TPM/BitLocker look at can be affected by hardware failure, which can cause the system to lock up With the recovery key, though, the system can be easily unlocked

TIP Once you have started the computer with the USB key, it is a good idea to remove the key and keep it in a safe place You can temporarily disable BitLocker or turn it off altogether by clicking Turn Off BitLocker in the BitLocker Drive Encryption control panel Disabling the drive lets the system be restarted without the key, as you might want to do to upgrade the system, change the BIOS, or to change any of the startup files, but the drive remains encrypted and uses a plain text key that has been stored on the computer Turning off BitLocker decrypts the drive, which can take some time

15:

You can duplicate either the startup key or the recovery password by clicking Manage BitLocker Keys in the BitLocker Drive Encryption control panel When you click Duplicate The Recovery Password, the same Save The Recovery Password dialog box opens that you saw earlier, and you can save a copy of the recovery password on another USB key, in a folder on a hard drive, or print it If you click Duplicate The Startup Key, you can choose another USB key on which to save it