Bitlocker and External Drives

[Circlenaut]

I'm trying to use one hard drive to store windows backup system images from two windows 10 machines. I would like the backups to be encrypted but it seems if I enable Bitlocker with the HD connected to one machine, it's not readable by the other.

I did the following:
1. On machine A, enabled Bitlocker on an externally connected drive.
2. Connected Bitlocker encrypted drive to computer B. Bitlocker on computer B does not accept password or recovery keys generated by computer A.
3. Did the same with machine B, with a different HD. Same issue, computer A can't read B's drive.

I understand that Bitlocker volumes are tied to a system's TPM, but I thought this is what a recovery key is for; for recovering data from a lost computer. Am I missing something here? What if someone's computer burns but they still have an external backup encrypted with Bitlocker? That data is gone because the TPM is gone? What if a person changes computers?

 

[Mushkins]

You're describing two separate things.

In the first situation, Bitlocker is working as intended. If you bitlocker encrypt a portable hard drive it will *only* work in the computer you encrypted it with by design. That's specifically the purpose of bitlocker encrypting a portable drive, so if you lose it nobody can get your data by plugging it into any old random PC.

I understand that Bitlocker volumes are tied to a system's TPM, but I thought this is what a recovery key is for; for recovering data from a lost computer. Am I missing something here? What if someone's computer burns but they still have an external backup encrypted with Bitlocker? That data is gone because the TPM is gone? What if a person changes computers?

A recovery key is only for recovering data from a trashed system. It's not a drive password that simply unlocks the drive, and it's not for using a bitlocker encrypted drive as an active drive on multiple PCs simultaneously.

What you can do is leave the drive plugged into machine A, share the drive, and on machine B map the drive on machine A as a network drive. Then set machine B to use the mapped drive as the location to save backups.

So the portable drive will be encrypted and tied to machine A, and both your backups will be stored on that encrypted drive. The only catch is that machine A needs to be turned on and have the drive plugged into it for machine B to back up successfully.

You could also use different encryption software entirely that's specifically designed for portable drives. I know SanDisk offers an encryption software with all it's thumb drives, and I believe Western Digital has some drives specifically marketed for what you're trying to do that come with drive encryption software. When you plug these drives in it asks for a password to unlock the drive on any PC you plug it in to.

 

[Circlenaut]

Thanks for clarifying Muskins. I suspected as much. No biggie, I've modified my backup plan to not include encryption. I'll just create an encrypted locker that I'll use for my sensitive files and leave Bitlocker on for the OS drive. I'll backup the locker to the external drives.

 

[John Connor]

Screw all that. I would use Truecrypt. Been using it for years. It's gone through an audit and is secure when the HDD is offline. If you use TC make damn sure you read the ENTIRE manual.

I would trust TC over any proprietary encryption. https://www.grc.com/misc/truecrypt/truecrypt.htm