Windows 10: New BEK file or full Bitlocker Key ID

My Hard drive failed, and I never set up bitlocker, but the hard drive was defaulted to bitlocker. How do I find out the default password for the drive I have the recovery key or the full Key ID I have 8 alphanumeric characters, but need the full Key ID?

:)

 

Bitlocker Process - 2 bek (startup) keys and one recovery key

I don't know if this what should happen but I was watching the process of key storage as I went through the BitLocker encryption process.

To see what was happening on the usb drive to which I was saving the startup and recovery keys I had to enable 'show system files' in order to see the .bek key.* I have seen posts stating that these are 'hidden files'. Maybe they are both? I am assuming that if the restart to check that usb key works succeeds, then presumably the machine is 'booting' from the usb key (.bek file)...?

1. Turned bitlocker on the C drive
2. usb drive was preselected to save STARTUP KEY
3. clicked on save
4. ONE bek key created on USB drive
5. Question re save location for recovery key > selected save to usb flash drive
6. USB drive preselected > clicked on save
7. Another bek key and recovery key saved with same timestamp
8. clicked on next > encrypt entire drive > run check > restart

So TWO .bek (startup) keys......Does anyone know why two?

One for each partition although I did not yet have BitLocker turned on my data partition.
Or maybe one for the Windows recovery partition?* Although I thought I had read that this remained unencrypted...?

 

Bitlocker Process - 2 bek (startup) keys and one recovery key

Just worked out what it is. There is a bek key for StartUp and a bek key for Recovery. A bit confusing as there is also a 'BitLocker Recovery Key' (different format to bek Recovery key)....???

Can anyone shed any further light?

UPDATE:
Must be that the system partition requires both startup and recovery .bek keys.

The data partition appears to only have one .bek key, presumably a recovery key.

The encryption of both system and data partitions has created just one BitLocker Recovery Key in a text file for each partition.

 

HELP: Automatic BitLocker Unlock.

more clear
0down voteaccepted
I managed to figure out how to fix this. It doesn't use the native auto-unlock function like I was hoping (rather a script that unlocks using a .BEK file, as I mentioned) but it seems to work just as well.

First, you need to create a .BEK file that can unlock the disk. This is the command I used:

manage-bde -protectors -add d: -rk c:\

Substitute d: with whichever drive you want to auto-unlock. The output will look something like this (take note of the "external key file name"):

BitLocker Drive Encryption: Configuration Tool version 10.0.10011
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Key Protectors Added:

Saved to directory c:\

External Key:
ID: {9DDF4900-5E08-479A-8C4C-6ADE2DA00551}
External Key File Name:
9DDF4900-5E08-479A-8C4C-6ADE2DA00551.BEK

Now you need to create the script to unlock the drive. Just create a batch file in the root directory with the following line:

manage-bde -unlock d: -rk C:\[external key filename]

Again, replace d: with the correct drive letter. Replace [external key filename] with the filename you got before.

Finally, you need to tell Windows to run this script at startup, before you log in. (Or at least I needed it to run then, because that's where my desktop, etc. are stored.) Here's how you do that:

• Press Win+R and enter gpedit.msc. (This is only in Pro, but so is BitLocker, so that's not an issue here.)
  
  
• On the left, navigate to Computer Configuration > Windows Settings > Scripts (Startup/Shutdown)
  
  
• Double-click "Startup" on the right
  
  
• Click "Add..." and select the batch file you created before.
  
  
• Click OK and exit Group Policy Editor.
  

Now you can reboot the computer to test it. You should see your drive automatically unlocked