Re: Bitlocker Windows 10 Drive
Rayén Rundall
I have a HD protected by Bitlocker. Login, password and restorekey are unknown and all I want to do is wipe the whole drive. When I try to boot from a windows installation cd I have no access to the drive since it asks for the restore key I don't have.
If that doesn't help, there is still the possibility to wipe the complete disk - after overwriting the first few megabytes the HDD will be recognized as fresh new HDD by Windows.You can do that for example using DBAN but don't forget to disconnect all the other HDDs before using it - otherwise you may delete the wrong HDD and lose all your data.
Press SHIFT-F10 or hit 'repair' in from the Windows installation to open up the command line, then execute the diskpart command and delete the partition, e.g.: list disk, select disk 0 or any other identifying the correct disk, list partition, select partition 1, or the encrypted one , in case there are multiple partitions, then delete partition override.
I just install Windows and when it comes to the time where setup asks you where you want to install Windows, I use "advanced options" to delete all partitions. Then let setup create a new partition for you and presto, you're done.
Did this numerous times on a bunch of notebooks we aquired for recycling (I work at a thrift store of some sort), which were all encrypted with Bitlocker. It must have been at least 100 notebooks from a office centre that went belly-up, no problems what-so-ever.
You dont absolutely need DBAN, GParted or another third party tool. Just Bootup WindowsPE (e.g. with a windows installation media on USB Stick or DVD) and use the windows format command to format the drive. When you have a Bitlocker encrypted drive, you just need to securely delete its encryption keys. For this its enough to format the drive.
I have an SSD that was locked by BitLocker. Thankfully I did not need to get at the data. I just wanted to reuse the drive. At first I thought I would need to use Linux as mentioned by another user, but thankfully I did not.
At first, it did not show up in my drive list. Luckily I got distracted with something else and left it plugged in. After about five minutes, it popped up on my list, and an additional pop up window came up asking for the BitLocker key.
For those wiping a disk or memory card with Linux, I can confirm that wiping the first 4 MB and creating a new fat32 filesystem worked fine for me for an SD card used in a Windows phone. (The SD card was no longer available after a device reset.) No need to delete partitions. (Not sure whether the phone would even accept an SD card without partition.)
I think that the method that I used was simpler than most of these suggestions. I just did this on a number of our company's laptops. We are closing and will be turning all of our assets, including the computers, over to the new tenants. So we needed a way to wipe all of the hard drives and I didn't really want to enter a BitLocker key for each of the units.
Using DISKPART to remove all partitions worked for me.If bitlocker is mandatory then first fully update windows and drivers and bios before enabling bitlocker. Otherwise you will need to do all the tedious stuff like pausing protection on/off after each reboot update.
I inherited a fully loaded Lenovo laptop that had Win8 that the local IT shop was hired to upgrade to Win10 The PC had bitlocker on and they had the key but somehow blew the install and told the customer it was trashed.
The fix was simple - boot to a Win10 bootable USB (or DVD if you have that option) When you get to the 'where to install' screen, delete all of the partitions - that wipes out the bitlocker info and Win10 installs without a hitch.
For an hour of my time and $25 for a new charger I got an i7 8gb touchscreen convertible that brand new was easily $1000 plus - not too shabby! The interesting thing was that Windows was automatically activated.
The Win10 files can be downloaded from Microsoft for free and as long as you have a Win7 or 8 license it will activate. Just go to -us/software-download/windows10 select create media to download the installation tool. The instructions for creating bootable USB or DVD media are on that page.
I have a laptop running Windows 7 Ultimate. I have encrypted my drives using BitLocker. Now I have also installed Lubuntu along with Windows. But my encrypted drives are not visible in Linux. How can I fix this?
My problem was that I could not boot Windows, and I needed a way to access my files on a Bitlocked partition. In order to do this, you need a bitlocker recovery password (8 groups of digits) and the ability to boot your system from USB.
CryptSetup has added experimental support for BitLocker as of version 2.3.0 (February 2020), which is available in Ubuntu's repos for 20.10 Groovy onwards, although support will likely improve in later versions.
When setting up BitLocker on a device choose the option that encrypts the whole device (requires more time). The other option uses Encrypt-On-Write conversion model that makes sure that any new disk writes are encrypted as soon as you turn on BitLocker (data that existed on the device before encryption began can still be read and written without encryption) and is not supported by Cryptsetup.
Once the drive is decrypted, you can use TrueCrypt instead; reading a System Encryption volume under Linux isn't supported by default, but someone has figured out a work-around. See How to use TrueCrypt-encrypted Windows system drives on Linux.
I tried @SrjCoder's suggestion of using a VM. But with VirtualBox on the Linux host, I was not able to see the encrypted drive in the guest Windows system. The unmounted block device that had the encrypted drive was not visible in the VM. I didn't try VMware, and I'm not a VirtualBox expert, so maybe I missed something there.
Finally I installed Windows 10 Pro on a separate machine, and connected the encrypted drive, Windows recognized it as a Bitlocker drive, and I was able to unlock it with the recovery key, and the valuable data was saved! The end.
If you're wondering why I didn't just boot the encrypted drive, it is in a bad state and cannot boot. It blue-screened trying to go back to a restore point. Luckily the data partition was still intact.
I don't know since when nemo supports it, but I installed Ubuntu on a second SSD in my school laptop and could just see the BitLocker'd drive in the "Devices" part of nemo's sidebar as "253 GB encrypted drive". When I clicked it it asked for my BitLocker key and for how long to remember it (not at all, until logout, permanent). When I entered the key it was successfully mounted as "Windows" with the path /media//Windows.
I had to type each fedora update windows recovery key when booted to windows, but that might be just my hardware and Nvidia stuff and eventually it just lost boot option to fedora ending running WSL or VM setup and second laptop just fedora bare metal
from within windows use the disk manager to shrink the windows partition and allow space for the fedora install. This is especially critical since you are using bitlocker. The space freed up must remain unallocated.
boot the fedora installation media and do the install. Do NOT create an additional esp partition but allow fedora to automatically perform the partitioning and install. It is best to allow both OSes to share the existing esp partition.
(experienced users may define their own partitions but normally fedora does it quite well with the automatic install)
I do not use bitlocker so have no experience with the stated need to use the uefi boot menu to boot windows. Yes, grub is the default boot loader in fedora and it is installed automatically. When dual booting the grub menu should show each time you boot, which normally allows the user to select the kernel or OS to boot.
This depends upon your hardware and what drivers you use. If you do not install software that requires locally compiled kernel modules then secure boot may remain enabled. I think windows 11 probably uses secure boot by default (and may even require it). You may also sign the locally compiled modules which will allow them to load and also allow keeping secure boot enabled.
If you have a GPU such as nvidia and use the nvidia drivers or use virtualbox to run VMs, both have locally compiled kernel modules and require that either you disable secure boot to use unsigned modules, or create a local signing key and enroll it into the bios so the modules are signed when compiled and continue to use secure boot.
I use secure boot, and have installed nvidia drivers as well as virtualbox from the rpmfusion repo. There is a package named akmods that manages compiling and signing these modules for me.
Once the package akmods is installed there is a readme file /usr/share/doc/akmods/README.secureboot containing the instructions on how to create and enroll the key so modules may be automatically signed and will load with secure boot enabled.
This may be a result of using bitlocker. Is it possible to disable bitlocker without a full reinstall?
If not then it should be possible to copy off the data you desire to keep, then do a new install of windows without bitlocker and start over with the fedora install.
It has been many years since I worked with windows at that level. His info reminded me of what I used to do when windows was my main OS and had forgotten by now. Admin tasks done 15 or more years back tend to be forgotten.
Have only booted windows once in the last 6 months and that was only for update purposes. Since windows does the auto updates without asking for permission I did not want it updating when I happened to be travelling and on a slow or metered connection.
If you really do not need windows it seems that you might consider installing fedora on the drive, then use libvirt and virt-manager to create a VM of about 50 GB or so in size and install windows 10 into that VM so it would be available if needed. I guess that it might be possible to use win 11 in that manner but I have not tried that yet. Win 11 requires secure boot and TPM. libvirt does provide secure boot, but I have not tested the TPM capabilities.
d3342ee215