Skip to content 
BitLocker
BitLocker is active on many corporate notebooks running Windows, often without users noticing. The encryption protects data in case of loss or theft. When decommissioning, however, the question arises whether it replaces erasure and whether BitLocker has to be disabled beforehand. This entry explains how it works, its limits and the right order.
In brief
BitLocker is the drive encryption built into Windows by Microsoft, which encrypts entire drives using XTS-AES. The key is usually protected by the computer’s TPM, so that data is readable only on its own device after a proper startup. For IT decommissioning, BitLocker is important protection until erasure, but it does not replace verifiable data erasure.
How BitLocker works
BitLocker encrypts the system drive and, if desired, additional drives. For removable media such as USB sticks, there is BitLocker To Go. The feature is included in Windows Pro, Enterprise and Education. On many devices running Windows Home, a simplified "device encryption" based on the same technology is available, which can be enabled automatically on suitable hardware.
| Component | Function |
|---|---|
| Encryption | XTS-AES with 128 bit (default) or 256 bit |
| TPM | Security chip that releases the key only if the startup process is unchanged; optionally with an additional PIN |
| Recovery key | 48-digit numeric code for emergencies, for example after a hardware replacement; often stored in Entra ID, Active Directory or a Microsoft account |
| Management | Group policies or device management, for example with Microsoft Intune |
What to note when retiring devices
- Encryption is not erasure: The data remains on the drive. Anyone who knows the recovery key can read it. Such keys often still exist years later in directory services or backups.
- "Encrypt used disk space only" option: Data that was deleted before BitLocker was switched on may lie unencrypted in the free area. Deleting the BitLocker key then does not act like a complete Crypto Erase.
- Disabling is usually unnecessary: "Disable BitLocker" decrypts the drive, which takes time. If the data carrier is then completely erased using a verified method, this step is generally not required. It makes sense if a device with an installed system is to be passed on internally.
- Proof missing: Neither encryption nor key removal produces a report for each data carrier.
Rule of thumb: BitLocker protects old devices on the way to erasure. It does not replace the erasure itself or its proof.
BitLocker in comparison
BitLocker is software encryption in the operating system. There are also self-encrypting drives, where the hardware encrypts, and on macOS the FileVault solution. An overview is given by the entry Hard drive encryption. Which erasure method suits which drive is described in our guide Formatted is not erased: erasing hard drives and SSDs securely. What to do when company devices are returned is explained in the offboarding checklist.
BitLocker and Second IT
Second IT erases data carriers using Blancco software, including hidden areas such as HPA and DCO on hard drives. For every device you receive a digitally signed erasure certificate with the serial number. Data carriers that cannot be erased are destroyed in-house in accordance with DIN 66399 (up to security level H-5 and E-5). More on certified data deletion.
Frequently asked questions about BitLocker
Do I have to disable BitLocker before selling a notebook?
If the drive is then erased completely and verifiably, generally not. The erasure overwrites or sanitizes the entire data carrier regardless of the encryption. What matters is that no firmware or BIOS locks remain active.
Is it enough to delete the BitLocker key?
Only under conditions: the entire drive must have been fully encrypted from the start, and no copies of the recovery key may still exist. Since this can rarely be proven with certainty, a verified erasure with a report is the safe route.
What happens to the recovery keys of decommissioned devices?
They remain stored in Entra ID, Active Directory or the Microsoft account until they are removed. After the devices have been verifiably erased, you should clean up the entries in line with your erasure policy.
In which Windows versions is BitLocker included?
BitLocker is included in Windows Pro, Enterprise and Education. On many devices running Windows Home there is a simplified device encryption based on the same technology, which can be enabled automatically on suitable hardware. For USB sticks there is BitLocker To Go.
What is the BitLocker recovery key?
A 48-digit numeric code for emergencies, for example after a hardware replacement. Anyone who knows it can read the encrypted data. It is often stored in Entra ID, Active Directory or a Microsoft account, and years later still in directory services or backups.
Encrypted is good, erased with a certificate is secure.
Send us your device list. You will receive your offer in 48 hours on average.