Windows 10: Able To Access BitLocker Files In Recent Files Without Credentials After Locking The...

Hello,


I use bit locker on usb drives and certain partitions on my computer. I use manage-bde -lock -ForceDismount x: to re-secure the drive when im done with it but still working on the machine. After execution I get "Volume x: is now locked"


I noticed that after dismounting the encrypted drives with the above mentioned command, "File Explorer" still keeps the files that reside on the encrypted drives in the "recent files" buffer and can still be viewed without creds.


I'm not worried now that I noticed it because I can update my Op Sec Procedures to include wiping the "recent files" buffer. Its kinda inconvenient and others may not be aware.


Its common to assume that while a user is logged in, that the user is in control of all local security issues. This is, of course, an antiquated perspective and leaves countless millions of users open to data breaches via various means. Back in the DOS days it was pretty easy to plug the holes and watch the logs but machines are so hyper complex that additional security software packages are handed this responsibility. That software assumes the same active user security status and is badly mistaken.


Please let the bit locker engineers know about this and have them modify the "recent files" registry to remove any files associated with an encrypted origin. Of for that matter, never update the "recent files" buffer with anything from an encrypted drive. Ill take security over convenience in this case...


thanks


***Edited Original Title From: Bit Locker Fail s***

:)

 

Recent File List

Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file1

Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file2
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file3
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file4
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file5
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file6
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file7
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file8
Remove-ItemProperty -Path "Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List" -name file9
...

you get the idea. ( too lazy to put it in a for loop and test it.

or just open regedit and remove all the fileX from that key.

 

Recent File List

that's all off already dude lol, I'm really surprised there is no fix for the recent files list/MRU in the file menu of programs haha

I appreciate the help, MS really needs to implement a Group Policy or a string that can do that for all programs installed

 

Recent File List

to prevent it from autopopulating try making the reg key
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
\Applets\Paint\Recent File List read only