How to Decommission a BitLocker Drive Permanently

Compromises in confidentiality can occur when computers or hard disks are decommissioned. For example, a computer that reaches the end of its usefulness at an organization might be discarded, sold, or donated to charity. The person who receives the computer might extract confidential files from the computer's hard disk. Even if the disk has been formatted, data can often be extracted.

BitLocker reduces the risks of decommissioning drives. For example, if you use a startup key or startup PIN, the contents of the volume are inaccessible without this additional information or the drive's saved recovery information.

You can decommission a drive more securely by removing all key blobs from the disk. By deleting the BitLocker keys from the volume, an attacker needs to crack the encryption-a task that is extremely unlikely to be accomplished within anyone's lifetime. As a cleanup task, you should also discard all saved recovery information, such as recovery information saved to AD DS.

To remove all key blobs on a secondary drive (data volume), you can format that drive from Windows or the Windows RE. Note that this format operation will not work on a drive that is currently in use. For example, you cannot use it to more securely decommission the drive used to run Windows.

To remove all key blobs on a running drive, you can create a script that performs the following tasks:

1. Calls the Win32_EncryptableVolume.GetKeyProtectors method to retrieve all key protectors (KeyProtectorType 0).
2. Creates a not-to-be-used recovery password blob (discarding the actual recovery password) by using Win32_EncryptableVolume.ProtectKeyWithNumericalPassword and a randomly generated password sequence. This is required because Win32_EncryptableVolume.DeleteKeyProtector will not remove all key protectors.
3. Uses Win32_EncryptableVolume.DeleteKeyProtector to remove all of the usable key protectors associated with the identifiers mentioned previously.
4. Clears the TPM by calling the Win32_TPM.Clear method.

For more information about developing a script or application to perform secure decommissioning on a BitLocker-encrypted drive, refer to the Win32_EncryptableVolume WMI provider class documentation at http://msdn.microsoft.com/en-us/library/aa376483.aspx and the Win32_TPM WMI provider class documentation at http://msdn.microsoft.com/en-us/library/aa376484.aspx.