FDE = Undecryptable Drives

[Rigo]

Just got an IdeaPad Flex 5 that wouldn't and she wanted her data.
Checked the drive on my computer and it said "bitlocker encrypted".
Humm!!
Let's see if I can revive the laptop itself, and I did.
Better disable the encryption on the drive I thought. No option to do it.
Googled up and ended up here: https://support.lenovo.com/us/en/so...on-hard-disk-drive-frequently-asked-questions
The drive auto-decrypts when accessed externally - really?
What's the point of the encryption here? Seriously????
Is this a case of "we do it because we can" thingy?

 

[seashore]

The drive auto-decrypts when accessed externally - really?

I must be missing something. Could you please quote the part of the page that says that?

 

[Rigo]

Could you please quote the part of the page that says that?

That's my interpretation:
'
If the key is on the drive, how do I prevent would-be thieves from stealing the data off my drive?
To completely protect your data, it is absolutely vital that a hard drive password be set. This can be a user password or both a user and master password. The hard drive password prevents unauthorized users from booting the drive and accessing your data, while full disk encryption prevents more sophisticated attacks, such as attempting to retrieve data directly from the drive's platters.'

Unless I misunderstood

 

[Markverhyden]

To completely protect your data, it is absolutely vital that a hard drive password be set. This can be a user password or both a user and master password.

Just like anything else that's password protected. You need the password to get to it.

Can't remove encryption.

How do I enable encryption?
There is no need to enable encryption. FDE drives always encrypt data on the disk. No initial set up is required. In fact, it is not possible to disable encryption on an FDE hard drive.

They use self encrypted drives. Everything is onboard the drive and it's automatic

 

[Rigo]

Just like anything else that's password protected

It's not protected until one sets up a password.
What's the point of the encryption? Which is what I'm not getting.

 

[nlinecomputers]

It's not protected until one sets up a password.
What's the point of the encryption? Which is what I'm not getting.

Any form of encryption needs a password of some kind. The process is not complete until that is done. Either the manufacturer would have to give you a precreated password or you have to create your own. On Windows when you create or login to an existing Microsoft Account that password is used to enable BitLocker. If the hard drive or SSD supports built in encryption then Windows will enable that under BitLocker.

 

[HCHTech]

It's not protected until one sets up a password.
What's the point of the encryption? Which is what I'm not getting.

It is not very clear. I found this article, which states the following tidbits:

Because of their on-board key management, general conformance to TCG Opal 2.0 or Enterprise, and use of the NIST's Advanced Encryption Standard (AES), SEDs are some of the most secure and widely available forms of data at rest protection available on the market today.

Encryption of data "at rest" is mentioned in every cybersecurity questionnaire I've seen. Although it is definitely confusing when you try to zero on on exactly what that means. An SED drive encrypts data as it is written, then decrypts it as it is read by the OS or software.

This article describes it this way:

Data at rest is data that is not actively moving from device to device or network to network such as data stored on a hard drive, laptop, flash drive, or archived/stored in some other way.

Ok, so data "just sitting there" on the drive not being used or moved/copied somewhere (which is "Data in motion").

Since an SED drive decrypts the data when it is used by the OS or software, then I am with you that I don't quite understand the value of encrypting data "at rest", because the mere act of accessing that data decrypts it! I do not understand what type of event encrypting data "at rest" is protecting against. Maybe someone else will explain it to me.

The article also says:

SEDs are considered a secure form of data at rest protection, but there's one glaring caveat to that statement: users need to set a unique password on their SEDs to have them lock when they're powered off.

So, this one I understand. That places password protection on accessing any data from the drive. You have to put it in when you boot the machine or it won't boot. If you take the drive out of the machine, then the data cannot be accessed without the password. This one makes sense. However if you do this and you DON'T shut your computer off, then the data is still accessible - it seems to me anyway. So the highest security depends on the user - the computer should be off whenever it isn't being used. As long as you are willing to give up that security, then SED drives work just like non-SED drives that have had bitlocker enabled when the drive is removed from the machine.

So it THAT is true (SED drive = Non-SED drive w/bitlocker), then why get an SED drive? That leads us back to point #1, "In order to obtain encryption at-rest". And why would you want that? I guess so you can check the "Yes" box on that cyber-security questionnaire.

I have a financial advisor client whose broker-dealer requires SED drives to use their software. I went through this whole thing trying to understand what that really got them, but I still don't really know. If someone can tell me what event encrypting data "at rest" is meant to prevent or protect against, then I would understand better.

Edit: I suppose in this case, requiring SED drives removes the user's ability to take the encryption off (like they could do by disabling bitlocker) so it could just be about that - preventing stupid human tricks.

Don't get me started on encrypting data "in motion". That's even thornier.

 

[nlinecomputers]

As to WHY the laptops are encrypted. Most people have quite a bit of personal data stored on them. Tax information, credit card and bank statements, medical data. It’s done to protect end users from theft. As most end users are too careless or ignorant to setup this on their own Microsoft forces the issue. Unfortunately that same cluelessness means that end users will never take note of that important password and then they will lose access to the drive when some problem corrupts their TPM chip and they get a BitLocker recovery prompt.

As techs we have to make it S.O.P. to collect the BitLocker recovery key when you check in a computer for service and perhaps offer to decrypt the drive for the client.

Honestly, most people really should use drive encryption but most people are too stupid to keep their password safe so it probably does more harm than good.

 

[nlinecomputers]

So it THAT is true (SED drive = Non-SED drive w/bitlocker), then why get an SED drive?

Speed. The drive itself performs the encryption so no CPU processing is needed. You also do not have to have a OS that is aware of the encryption at all. You’ll be prompted for a password before the system boots. Though with BitLocker and a TPM chip that password is managed by them linked to your Windows authentication. This is done with BitLocker’s encryption or the built in one on the drive.

 

[HCHTech]

Honestly, most people really should use drive encryption but most people are too stupid to keep their password safe so it probably does more harm than good.

Agree. With SED drives, as soon as you tell folks they have ANOTHER password to remember and input every time they cold-start their computer, they will balk and ask you to remove it.

Side note, that article states that Samsung SSDs are SED and have been for a while. But because most installations do not set a drive password, it's of little benefit (other than protecting data "at rest", again, whatever value that might have).

 

[nlinecomputers]

Agree. With SED drives, as soon as you tell folks they have ANOTHER password to remember and input every time they cold-start their computer, they will balk and ask you to remove it.

Side note, that article states that Samsung SSDs are SED and have been for a while. But because most installations do not set a drive password, it's of little benefit (other than protecting data "at rest", again, whatever value that might have).

But you will not. On Windows it will be incorporated into the standard boot process just like a BitLocker system.

 

[HCHTech]

Speed. The drive itself performs the encryption so no CPU processing is needed.

That may be why your or I would choose an SED drive, but it's not like this is some kind of marketing feature promoted to drive sales. I doubt that firms requiring SED drives for their employees could be doing so because SED = secure & fast whereas Non-SED + Bitlocker = Secure and, I don't know, "less fast"? I've never once worked with a bitlockered computer and thought "Boy, this thing is SLOW". So the speed penalty must not be dramatic.

 

[nlinecomputers]

That may be why your or I would choose an SED drive, but it's not like this is some kind of marketing feature promoted to drive sales. I doubt that firms requiring SED drives for their employees could be doing so because SED = secure & fast whereas Non-SED + Bitlocker = Secure and, I don't know, "less fast"? I've never once worked with a bitlockered computer and thought "Boy, this thing is SLOW". So the speed penalty must not be dramatic.

No Not NOW in the age of SSDs. But SED drives have been around for about 15-20 years when HDD ruled and CPUs were slower and Bitlocker wasn't fully defined. In many ways, they are pointless now. But not so much when first introduced.

 

[YeOldeStonecat]

That may be why your or I would choose an SED drive, but it's not like this is some kind of marketing feature promoted to drive sales. I doubt that firms requiring SED drives for their employees could be doing so because SED = secure & fast whereas Non-SED + Bitlocker = Secure and, I don't know, "less fast"? I've never once worked with a bitlockered computer and thought "Boy, this thing is SLOW". So the speed penalty must not be dramatic.

Hardware encrypted drives will blow non hardware encrypted drives out of the water. Differences 'tween the two can depend on say, which software is doing the encryption. Years ago I used to manage some fleets of laptops for healthcare and used a 3rd party software encryption (based on Checkpoint..but was under a different brand). They had spindle drives back then, and...holy smokes...did that software crush the laptops performance. During a new laptop purchase I got some Dell Latitudes with hardware encrypted drives (daughtercards on them)...and wow what a difference.

Bitlocker doesn't put nearly the load on drives though. That 3rd party encryption software I used (based on checkpoint)...it seemed to cause a >50% failure rate of the drives over 5 years..worked them very hard. Thankful for SSDs now.

 

[fincoder]

Better disable the encryption on the drive I thought. No option to do it.

I think it's unlikely that an ordinary Lenovo Ideapad model would have Full Disk Encryption. Surely only some high-end ThinkPad models would have FDE?

I use command prompt and manage-bde commands to check encryption and turn it off.

> manage-bde -status
> manage-bde c: -off

 

[Porthos]

Since it is probably Win 11 home, I suspect device encryption. Not FDE.
Everyone needs to be prepared for this on all OEM laptops and some AIO's. This is the current reality.

 

[nlinecomputers]

Since it is probably Win 11 home, I suspect device encryption. Not FDE.
Everyone needs to be prepared for this on all OEM laptops and some AIO's. This is the current reality.

All Windows 11 PCs, not just laptops. There’s a reason TPM is required for Windows 11.

 

[Porthos]

All Windows 11 PCs, not just laptops.

I have not seen it on any of the desktops I have set up yet. But when I do the next one I will look again.

 

[Sky-Knight]

Win11 HOME, Win11 Pro follows the same rules as 10 did, which doesn't arm the device encryption until it's connected to a Microsoft Account, or to an AzureAD.

Technically Win11 Home still follows this pattern, it just won't let you get started without a Microsoft account to link the machine to, despite the other thread on this forum that reports options to the contrary.

@Rigo assuming the device is asking for a bitlocker recovery key on mount from another windows system, you need that recovery key to get the data. The key will be in the client's Microsoft account they used when they setup their laptop. If they do not know what that account is, or have lost access to it, the data is GONE. And no, you cannot fix that stupid, so don't even try.

 

[fincoder]

Technically Win11 Home still follows this pattern, it just won't let you get started without a Microsoft account to link the machine to, despite the other thread on this forum that reports options to the contrary.

You don't believe the options reported in the other thread?

The oobe\bypassnro script and the registry setting it changes are included in the OS by Microsoft for a reason. They are widely publicised on the net and still haven't been removed so we can assume Microsoft wants the option there for IT departments and techs.