Windows 10: Full-disk encryption of an SSD with Bitlocker. Over-provisioning? Does TRIM work?

Hello everybody,

I wonder if it is advisable in the case of a complete encryption of an SSD using Bitlocker, to create an unencrypted partition in the size of x percent to give the controller free space in addition to the factory over-provisioning for maintenance tasks like wear leveling.

Opinions seem to differ here.
Some say with full disk encryption everything the controller can see are occupied blocks - in such a case an unencrypted area would make perfect sense.
On the other hand, Bitlocker should support TRIM and thus the controller should be able to "recognize" and use the free space on the encrypted partition.

But, does TRIM even work? With an encrypted partition the tool "trimcheck" show me the restult "INDETERMINATE".
When the partition is unencrypted it works as usual result: "TRIM appears to be WORKING".
With VeraCrypt of course without blocking the TRIM command in the settings I get the same result.

What's right? Does the controller really only see a full SSD - despite TRIM?!

How are your experiences in this regard? Do you create an unencrypted area or do you "only rely" on the factory over-provisioning?
Are there any official recommendations from microsoft in this regard?

Thanks for reading and for every tip!

Greetings,
Martin

:)

 

Did trim works with encrypted ssd drive?

Hi did trim works on Ssd encrypted drive?

Windows 10 Pro os

 

Including Bitlocker Pre-Provisioning


Hi @Kari,

That was an awesome Tutorial, exactly what I've been looking for !

I have been doing a bit of experimenting and found that a slight modification to your procedure can be used to pre-provision Bitlocker encryption, as long as the machine has a TPM chip present and activated on the motherboard. This pre-provisioning, if successful, could save a few hours as compared to configuring it post-install.
Note: all of the following worked on Win 10 Enterprise x64 1709 on both an old Laptop (non-UEFI, non-Secure Boot e.g. a 10 year old Dell Latitude E4200 ) and a modern desktop (Dell Optiplex 5040 w UEFI and Secure Boot).
All that's needed is to insert a step between 2.6 and 2.7 which would check if the destination drive is encryptable, and, if it is then enable encryption of used space. Because the 'used space' at that point is almost zero it gets encrypted almost instantaneously. But, because the drive is now encrypted, anything that DISM adds to the drive gets encrypted on the fly ! End result is that when the installation is finished the drive is encrypted with Bitlocker and just needs a 'protector' (e.g. TPM and PIN) added ..

Here's what worked for me ....
- just after step 2.6, check that G: drive is actually encryptable (this also checks the BIOS, TPM activated etc.)
run command 'manage-bde -status' (if that lists the volume as encryptable, then we're good to go to next ..)
run command 'manage-bde -on G: -used' (that turns on bitlocker for the drive, and should finish after a few seconds ...... just wait a few seconds and verify that another 'manage-bde -status' now shows 100%)
- .. now proceed to step 2.7

At the end of the installation and after first bootup and logon you should see a little yellow triangle as well as an unlock icon on the drive, showing it's encrypted but with a 'clear protector' ...... then just need to add a protector, like TPM and PIN e.g. 'manage-bde -protectors -add c: -TPMAndPIN' where you will be prompted for PIN, and if all goes well, will be prompted to enter PIN in order for machine to boot up.

 

BitLocker Encrypted Hard Drive to MAC

Hi,



Thank you for posting your query in Microsoft Community. I regret the inconvenience caused to you. Let me help you.



I suggest you to perform below mentioned steps to disable BitLocker.

To disable BitLocker I would suggest you try the following steps and see if it helps.

• 
  Press Windows key + X and click on
  Control Panel.
  
• 
  Change View by from Category
  to Large Icons/Small Icons.
  
• 
  Click on BitLocker Drive Encryption and click on
  Turn BitLocker Off.
  
• 
  Follow on screen instructions. Click on Decrypt the Drive
  when the message appears.
  

I would suggest you click on the link below and refer the following article.

Scenario 12: Turning Off BitLocker Drive Encryption (Windows 7)

Scenario 12: Turning Off BitLocker Drive Encryption (Windows 7)

(You can refer the steps in the above link as they are applicable for Windows 10 as well)



Check if it helps.



I hope the information helps. Please keep us posted on the issue. We will be happy to assist you accordingly.

Thank you.