What is BitLocker? How does it work?

BitLocker

Windows BitLocker Drive Encryption is a data protection feature available in Windows Vista Enterprise and Windows Vista Ultimate for client computers and in Windows Server 2008. BitLocker provides enhanced protection against data theft or exposure on computers that are lost or stolen, and more secure data deletion when BitLocker-protected computers are decommissioned.

Data on a lost or stolen computer is vulnerable to unauthorized access, either by running a software attack tool against it or by transferring the computer’s hard disk to a different computer. BitLocker helps mitigate unauthorized data access on lost or stolen computers by combining two major data-protection procedures:
•
Encrypting the entire Windows operating system volume on the hard disk. BitLocker encrypts all user files and system files in the operating system volume, including the swap and hibernation files.
•
Checking the integrity of early boot components and boot configuration data. On computers that have a Trusted Platform Module (TPM) version 1.2, BitLocker leverages the enhanced security capabilities of the TPM to help ensure that your data is accessible only if the computer’s boot components appear unaltered and the encrypted disk is located in the original computer. If you enable BitLocker on a computer that has a TPM version 1.2, you can add a second factor of authentication to the TPM protection. BitLocker offers the option to lock the normal boot process until the user supplies a personal identification number (PIN) or inserts a USB device (such as a flash drive) that contains a BitLocker startup key. These additional security measures provide multifactor authentication and helps ensure that the computer will not start or resume from hibernation until the correct PIN or startup key is presented.
BitLocker is tightly integrated into Windows Server and provides enterprises with enhanced data protection that is easy to manage and configure. For example, BitLocker can use an existing Microsoft Active Directory Domain Services (AD DS) infrastructure to remotely store BitLocker recovery keys. BitLocker also provides a recovery console that enables data retrieval for non-domain-joined computers or computers that are unable to connect the domain (for example, computers in the field).