1

After installing linux mint alongside my w10 partition a few months ago the w10 partition was suddenly encrypted with bitlocker. The reason given was, that the guidelines for the secure boot were unexpectedly changed, and thus the drive got encrypted. Since i did not really need w10 anymore, i didn't really try to get the key (that i didn't have written down at the time, since i never manually enabled said encryption).

Now i booted into the w10 partition again. Here i now saw that below the field where i can enter the key a message tells me to follow a link (looks kinda like this "go.microsoft.com/fwlink/?linkID=XXXXX" with distinct numbers at the end. The text also gives me a Key ID that i should enter in the website that opens with the link.

Now, onto my question: Is this link really where i can find my key? After going through some forums relating to finding a bitlocker key there was no mention of the possibility of the bitlocker screen giving you a link where you might recover your key. Is it possible that this encryption is not at all a bitlocker encryption and maybe caused by malware?

Improve this question

1 Answer 1

Reset to default
2

After installing linux mint alongside my w10 partition a few months ago the w10 partition was suddenly encrypted with bitlocker. The reason given was, that the guidelines for the secure boot were unexpectedly changed, and thus the drive got encrypted. Since i did not really need w10 anymore, i didn't really try to get the key (that i didn't have written down at the time, since i never manually enabled said encryption).

It is not possible for BitLocker to become enabled without manual user intervention. The process of enabling BitLocker prompts you to backup the recovery key, the encryption process will not allow you to continue, if you do not backup the recovery key.

Now it's possible, if the device is connected to an Active Directory domain, for an Administrator to enable BitLocker. Based on your description of the events I don't believe that applies to your case.

BitLocker does not become enabled, due to a configuration change, if BitLocker and/or Device Encryption were already enabled then the recovery key would be required. If you are being prompted for recovery key, afer you made a configuration change, then it's possible Device Encryption was enabled.

The recovery key for Device Encryption is automatically synched to your Microsoft Account. Device Encryption is enabled by default, on certain types of devices, I personally have only see it enabled on tablet devices.

Now i booted into the w10 partition again. Here i now saw that below the field where i can enter the key a message tells me to follow a link (looks kinda like this "go.microsoft.com/fwlink/?linkID=XXXXX" with distinct numbers at the end. The text also gives me a Key ID that i should enter in the website that opens with the link.

Since you have failed to provide the information to identify the page you are being directed to, I can only guess that the contents of the page are dynamic, based on the code you were provided. If that is the case then the page would indeed provide you the recovery key that you are being prompted for.

Is this link really where i can find my key?

Yes

After going through some forums relating to finding a bitlocker key there was no mention of the possibility of the bitlocker screen giving you a link where you might recover your key.

The entire process to enable BitLocker is well documented on Microsoft's website. It is not possible to enable BitLocker without being prompted to backup your recovery key. Device Encryption is also well documented, which I suspect, is what is actually enabled. While Device Encryption and BitLocker are both full disk encryption solutions, BitLocker is only supported on Windows 10 Professional, while Device Encryption is typically only enabled by default on other Windows 10 editions.

Is it possible that this encryption is not at all a bitlocker encryption and maybe caused by malware?

Only you can determine if your system is infected with malware. However, if this was a case of malware, you would not be prompted for a recovery key. You also would be able to boot into Windows. Which is the only reason I know this isn't a case of a malicious infection

Improve this answer
2
  • Thank you very much for the detailed response. And yeah, i think that device encryption was the thing that was enabled by default. Since posting my question i've read that both device encryption and bitlocker rely on the same "engine" somehow, thus making both their "recovery screens" look rather similar. My last question would be, if the link where the key might be stored is "safe". Since i am rather on the careful side with malware i am always really suspicious just following links. That said, the "go.microsoft.com" url seems to be an official microsoft domain. Am i correct in assuming that?
    – Felix R
    Commented Oct 3, 2019 at 21:31
  • 1
    Any subdomain on the microsoft.com domain is safe. In other words only Microsoft can create a page that exists on https://*.microsoft.com/
    – Ramhound
    Commented Oct 3, 2019 at 21:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .