To avoid entering BitLocker recovery mode, you can disable BitLocker temporarily, which allows you to change the TPM and upgrade the operating system. When you re-enable BitLocker, the same encryption keys will be used. You can also choose to decrypt the BitLocker-protected volume, which will completely remove BitLocker protection. You can re-enable BitLocker only by repeating the process to create new keys and reencrypt the volume.
From Control Panel, open BitLocker Drive Encryption.
Click Suspend Protection for the volume that has BitLocker enabled to use a clear key. To remove BitLocker completely, click Turn Off BitLocker.
The operating system fails to start in a dual-boot configuration You can dual-boot a computer after enabling BitLocker. However, the second operating system instance must be configured on a different partition. You cannot dual-boot to a second operating system installed on the same partition.
The operating system fails to start if you move the hard disk to a different computer BitLocker is designed to protect data from offline attacks, such as attacks that bypass operating system security by connecting the hard disk to a different computer. The new computer will be unable to decrypt the data (even if it has a TPM chip in it). Before moving a BitLocker-encrypted disk to a different computer, disable BitLocker. Re-enable BitLocker after transferring the disk. Alternatively, you can use the recovery key to start Windows after moving the hard disk to the new computer.
The data on the hard disk is unreadable using standard disk recovery tools For the same reasons stated in the previous bullet point, BitLocker files are unreadable using standard disk recovery tools. Some day recovery tools that support decrypting BitLocker files using a recovery key might be available. As of the time of this writing, your only opportunity for recovering BitLocker encrypted files is to start Windows 7 using the BitLocker recovery key. For this reason it is very important to regularly back up BitLocker-encrypted volumes.
In this practice, you simulate the recovery of a lost EFS encryption certificate.
In this exercise, you encrypt a file. Windows 7 automatically generates an EFS key if you don't already have one.
Log on to a computer running Windows 7 as a standard user.
Create a file named Encrypted.txt in your Documents folder.
Right-click the Encrypted.txt file, and then click Properties.
On the General tab of the Properties dialog box, click Advanced.
Select the Encrypt Contents To Secure Data check box, and then click OK twice.
In the Encryption Warning dialog box, select Encrypt The File Only, and then click OK.
Notice that Windows Explorer displays the Encrypted.txt file in green.
Double-click the Encrypted.txt file to open it in Microsoft Notepad. Then add the text "This file is encrypted." Save the file and close Notepad.
Double-click the file to verify that you can open it, and then close Notepad again.
Now you have encrypted a file, and no user can access it without your EFS key.
In Exercise 1, you encrypted a file. In this exercise, you back up the EFS key that was generated automatically when you encrypted the file. Then you delete the original key and determine whether you can access the EFS-encrypted file. To complete this practice, you must have completed Exercise 1.
Click the User Accounts link twice.
In the left pane, click the Manage Your File Encryption Certificates link.
The Encrypting File System Wizard appears.
On the Manage Your File Encryption Certificates page, click Next.
On the Select Or Create A File Encryption Certificate page, leave the default certificate (your EFS certificate) selected, and then click Next.
On the Back Up The Certificate And Key page, click Browse and select the Documents folder. For the file name, type EFS-cert-backup.pfx. Click Save, and then type a complex password in the Password and Confirm Password fields. Click Next.
If the Update Your Previously Encrypted Files page appears, leave all check boxes cleared and then click Next.
On the Encrypting File System page, click Close.
In Windows Explorer, open your Documents folder and verify that the EFS certificate was exported correctly.
Click Start, type mmc, and then press Enter to open a blank MMC.
Select My User Account, and then click Finish.
Expand Certificates – Current User, expand Personal, and then select Certificates.
In the middle pane, right-click your EFS certificate, and then click Delete.
In the Certificates dialog box, click Yes to confirm that you want to delete the certificate.
Log off the current desktop session and then log back on. Windows 7 caches the user's EFS certificate. Thus, if you remained logged on, you would still be able to open your encrypted file.
Open the Documents folder and double-click the Encrypted.txt file. Notepad should appear and display an "Access is denied" error message. This indicates that the file is encrypted but you don't have a valid EFS certificate.
In this exercise, you recover a lost EFS key and use it to access encrypted data. To complete this exercise, you must have completed Exercises 1 and 2.
In the Documents folder, double-click the EFS-cert-backup.pfx file that you created in Exercise 2.
The Certificate Import Wizard appears.
On the Password page, type the password you assigned to the certificate. Then click Next.
Click OK to confirm that the import was successful.
Open the Documents folder and double-click the Encrypted.txt file. Notepad should appear and display the contents of the file, indicating that you successfully recovered the EFS key and can now access encrypted files.