Microsoft BitLocker

Full volume encryption for operating system drives

BitLocker encrypts the entire volume that Windows boots from, including system files, page and hibernation files, and free space, so data on the drive is unreadable without the volume's key. Encryption and decryption happen transparently in a filter driver as blocks are written and read, so applications work normally once the volume is unlocked. Because the operating system volume is protected, the drive cannot be read by removing it and attaching it to another machine.

Fixed data drive encryption

BitLocker also protects internal non-system volumes such as secondary partitions and additional internal disks used for data. Each such volume is encrypted with its own key and carries its own set of protectors, so it can be unlocked independently of the operating system volume. Data volumes can be configured to unlock automatically once the operating system volume is unlocked, or to require a password or smart card at access time.

BitLocker To Go: encryption for removable drives (USB flash drives, external disks)

BitLocker To Go applies volume encryption to removable media such as USB flash drives and external hard disks. The user chooses an unlock method when encrypting, typically a password or a smart card, and is prompted for it whenever the drive is attached to a computer. Because the protection travels with the media, a lost or stolen removable drive does not expose its contents, and recovery information for these volumes can be captured in the same way as for fixed drives.

AES encryption with 128-bit or 256-bit keys

BitLocker encrypts volume data with AES, and administrators can select a key length of 128 bits or 256 bits. The choice is set before a volume is encrypted, since changing it afterward requires decrypting and re-encrypting the volume. The larger key length increases cryptographic strength at some cost in throughput on hardware without accelerated AES instructions.

XTS-AES cipher mode (default) and AES-CBC mode support

BitLocker can operate AES in XTS mode, which is designed for disk encryption and reduces the ability of an attacker with access to the ciphertext to manipulate stored data in a predictable way; this is the mode used by default on current Windows versions for fixed and operating system drives. AES in CBC mode with a diffuser option remains available and is used where the volume must be readable by older Windows versions that do not support XTS, which matters most for removable drives moved between machines. The mode is chosen at encryption time and applies for the life of the encrypted volume.