21

Why is my Windows 11 installation drive shown as encrypted in Linux GUI when we want to simply mount the drive, when there are following points to note?

  1. BitLocker is disabled
  2. Data encryption is not enabled.
  3. Norton AntiVirus is there, but it does not show any encryption-related stuff.
  4. Windows has a Local Administrator enabled (I have access).

I tried following Linux distributions for double checking.

Screenshots are following for some of the commands highlighted in comments.

Enter image description here

Enter image description here

The output of the command manage-bde -status C: is the following:

cd C:\Windows\System32
manage-bde -status C:

Output:

BitLocker Drive Encryption: Configuration Tool version 10.0.22621
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Volume C: [] [OS Volume]

Size:                 476.21 GB
BitLocker Version:    2.0
Conversion Status:    Used Space Only Encrypted
Percentage Encrypted: 100.0%
Encryption Method:    XTS-AES 128
Protection Status:    Protection Off
Lock Status:          Unlocked
Identification Field: Unknown
Key Protectors:       None Found

I just either need my drive normally accessible as other drives are or need to extract that secret for decryption if possible.

Ian Kemp
  • 1,086
  • 11
  • 18

1 Answers1

47

You do in fact have a BitLocker-encrypted disk – it's in a "dormant" or "clear key" mode, where the disk directly stores its own decryption key so there's no passphrase or anything. (This has the advantage of reducing cleartext data to the minimum should you ever decide to enable BitLocker in the future.)

Currently Linux cryptsetup does not yet support this mode, but you might be able to access the volume using the older tools, either dislocker or bdemount (the latter from "libbde") – they aren't integrated into the graphical file manager, but have more extensive support of various BitLocker configurations.

You also can fully decrypt the disk by disabling BitLocker using bde-manage -off.

grawity
  • 501,077