Reflection on Software Architecture

There is a way to encrypt removable drives.  Prior to attempting to enable BitLocker on your removable drive you need to ensure that the drive is formatted using the NTFS file system and you have backed up the data inside in case things go wrong and you cannot unlock your drive.

This link provides a high level overview of BitLocker: http://en.wikipedia.org/wiki/BitLocker_Drive_Encryption

Here is the executive version for the non-techie people: http://technet.microsoft.com/en-us/windowsvista/aa906018.aspx

Here is a reference to BitLocker FAQ: http://technet2.microsoft.com/WindowsVista/en/library/58358421-a7f5-4c97-ab41-2bcc61a58a701033.mspx?mfr=true

And if you’re really geeky and want to learn more about what encryption algorithm is used and why..  http://download.microsoft.com/download/0/2/3/0238acaf-d3bf-4a6d-b3d6-0a0be4bbb36e/BitLockerCipher200608.pdf

Notes:

Before you begin

Before you start to encrypt your removable drive, you will need to think where you will store the key that will be used to unlock the drive.  If you loose this key you will loose access to the data in the drive.  To know where you want to store the key you need to know how badly do you want to protect the data inside.

Personally, I wanted a level of security over my data so that if I loose my USB drive someone can't just plug it into a computer and get access to the data.  I am willing to sacrifice a little bit of security for the purpose of convenience.  So I have actually decided to store the keys in 2 places, one is on my laptop hard drive, the other is on my home computer hard drive and I also have a backup key in another USB drive.  This is so I can easily gain access to my USB key data on both computers and at the same time, I can also get access to the USB data on another computer by having the key on another USB drive.  I have also chosen the default 128 bit AES key because I think this is adequate for my purpose.

To run the utility you will need to do:

cscript manage-bde.wsf

To encrypt the removable drive:

Assumptions:

• Your removable drive has been assigned the drive letter R:
• I want to have a recovery password automatically generated for me
• I want to put my recovery key on D:\

Command to type:

cscript manage-bde.wsf -on R: -recoverykey d:\ -recoverypassword

This will encrypt the removable drive and put the key file in your d:\. 

After the encryption, you will see your recovery password generated.  Make sure you make a copy of this.  It should be in a format similar to this:  111950-074411-044704-271238-313841-511626-093401-026598

To see the key file you will need to make sure in windows explorer you set the option to be able to view hidden and operating system files.  The file will look something like:  E181C91B-20A9-4702-87C9-33F901D38DE9.BEK

Note that it may take some time for the encryption process to complete.  You can check the progress by typing the command below:

cscript manage-bde.wsf -status R:

To access your BitLocked drive:

When you load your removable drive, you an manually type the following (if you want to use your password) - (please use your specific password)

cscript manage-bde.wsf -unlock R: -recoverypassword 111950-074411-044704-271238-313841-511626-093401-026598

Or you can type the following command (Please use your specific key file)

cscript manage-bde.wsf -unlock R: -recoverykey D:\E181C91B-20A9-4702-87C9-33F901D38DE9.BEK

If you want to make life easier for yourself, you can create a batch file with the command above in it. 

WARNING: Again before I get flame mails, by keeping your key file in your computer and if you type in your password in the batch file you are reducing the security of your encrypted drive because if someone has access to your computer and your removable drive, they can potential decrypt it.

Parameter Reference (just the relevant ones)

The table below provides a list of the parent parameters and the sub-parameters for each (where applicable)

Parent level syntax:

manage-bde[.wsf] -parameter [arguments]

-status   

manage-bde -status [Volume]   [{-ProtectionAsErrorLevel|-p}]  [{-ComputerName|-cn} ComputerName]  [{-?|/?}] [{-Help|-h}]

Examples:

    manage-bde -status

    manage-bde -status e:

    manage-bde -status e: -ProtectionAsErrorLevel

-on

manage-bde -on Volume

        [{-RecoveryPassword|-rp} [NumericalPassword] ]

        [{-RecoveryKey|-rk} PathToExternalKeyDirectory]

        [{-StartupKey|-sk} PathToExternalKeyDirectory]

        [{-TPMAndPIN|-tp} PIN]

        [{-TPMAndStartupKey|-tsk} PathToExternalKeyDirectory]

        [{-EncryptionMethod|-em}

            {aes128_diffuser|

             aes256_diffuser|

             aes128|

             aes256}]

        [{-ComputerName|-cn} ComputerName]

        [{-?|/?}] [{-Help|-h}]

Examples:

    manage-bde -on C: -RecoveryPassword

    manage-bde -on C: -RecoveryKey e:\ -RecoveryPassword

    manage-bde -on C: -rp -rk "f:\Folder" -SkipHardwareTest

-off

manage-bde -off Volume  [{-ComputerName|-cn} ComputerName]  [{-?|/?}] [{-Help|-h}]

-unlock

manage-bde -unlock Volume

                    {[{-RecoveryPassword| -rp} NumericalPassword] |

                    [{-RecoveryKey|-rk} PathToExternalKeyFile]}

                    [{-ComputerName|-cn} ComputerName]

                    [{-?|/?}] [{-Help|-h}]

Examples:

    manage-bde -unlock -?

    manage-bde -unlock e: -RecoveryPassword ...

    manage-bde -unlock e: -RecoveryKey "f:\File Folder\Filename"

-autounlock

manage-bde -autounlock  Volume

                    [-enable | -disable | -ClearAllKeys] volume

                    [{-ComputerName|-cn} ComputerName]

                    [{-?|/?}] [{-Help|-h}]

Examples:

    managee-bde -autounlock -enable E:

    managee-bde -autounlock -disable E:

    managee-bde -autounlock -ClearAllKeys C:

-protectors

manage-bde -protectors

manage-bde -protectors -get Volume -parameter [arguments]

manage-bde -protectors -add Volume -parameter [arguments]

manage-bde -protectors -delete Volume -parameter [arguments]

manage-bde -protectors -disable Volume

manage-bde -protectors -enable Volume