2

BitLocker to Go volumes are fully supported on Windows 7 and later. For compatibility with systems running Windows XP or Windows Vista, a utility called BitLocker to Go Reader (archived) is provided to enable read-only access to the volume on these older systems.

The BitLocker to Go Reader, bitlockertogo.exe, is included on encrypted volumes as an unencrypted file that is readable by older versions of Windows:

By default, BitLocker To Go Reader is stored on an un-encrypted part of removable drives that are protected with BitLocker. (Source)

However, if BitLocker is supposed to encrypt the entire volume, including filesystem metadata, how does it leave a file unencrypted and readable in this manner? Does this mean that it leaves a portion of the volume's filesystem metadata unencrypted for this purpose? (If so, how does it do this without interfering with the rest of the filesystem, and how does it ensure that the encrypted portions are not accidentally overwritten by the legacy OS?) Note that this does not work on NTFS volumes:

To use BitLocker To Go Reader on a computer that is running Windows XP or Windows Vista, your BitLocker-protected removable drive must be formatted by using the exFAT, FAT16, or FAT32 file system. If the drive is NTFS formatted, it can only be unlocked on a computer that is running Windows 7.

bwDraco
  • 46,683

1 Answers1

0

Okay, I just opened a 4 GB BitLocker-protected flash drive under Linux (openSUSE Leap 42.2) and got some interesting results.

The drive looks like any other normal FAT32 volume and contains the BitLocker to Go Reader executable, localization and AutoRun data, and a Read Me link (to a page which has since been taken down as Microsoft has since removed most non-Windows 10 help content). The rest of the drive is quite peculiar:

  • The actual encrypted volume is stored as a series of files just under 4 GiB in size (for drives larger than 4 GB) or as a single file that fills nearly the entire volume (for smaller drives). These files are named COV ####. ER, where #### is a sequence number starting from zero.
  • There are additional padding files which start with PAD, most of which are zero bytes in size. I'm not sure what the purpose of these files are. For FAT16 volumes, they would completely fill up all available root directory entries, preventing any more files from being created, but I don't quite see how this would work with FAT32 or exFAT.
  • All of these files are marked read-only, hidden, and system, preventing them from being accidentally overwritten or even read.

This directory listing should give you a better idea of what the drive actually contains.

Community
  • 1
bwDraco
  • 46,683