The difference between a BitLocker startup and recovery key

bitlockerdisk-encryption

I would like to encrypt a system partition using BitLocker using a password (manage-bde -protectors -add c: -pw), but (safely) store a key elsewhere if I ever forget the password. Should I add a recovery key (-rk) or a startup key (-sk)?

It seems that I would be able to use both for accessing data in case of emergency. Is there anything that I could do with a recovery key that I could not do with a startup key and vice versa?

Best Answer

I also wondered this and experimented; this is what I know so far:

  • Both commands create an external *.BEK keyfile.

  • After you have created a -StartupKey and -RecoveryKey they become inseparable in the protector-overview. (manage-bde C: -protectors -get) This lists all keys and labels the keys in question 'External key'. Only if you remember the {id}, you can tell the difference.

I cannot find any sources that can validate claims/explanations about this topic, however, part of an answer might help/trigger one:

I suspect it is a legacy issue. A command was introduced into an earlier version of Bitlocker and later one it was expanded. Nowadays it might make more sense to call it (-)ExternalKey which by the way, you can actually use to define a -type if you use the -delete command to revoke all Externalkeyfile-access from a drive.

In contrast, if we move a fixed(*) drive to another system (or Bitlocker detects system-compromising-integrity changes), it can apparently demand for a recovery password. If we expand the language, a recovery key also is able to unlock the drive:

  • I can confirm that [Load key from USB-station]-button works with both key-type. (Multiboot, unlocked system drive of other OS.) However, Bitlocker was not in 'Recovery mode' that might be triggered by certain changes.
  • I can confirm that you can boot a system from a -RecoveryKey. (Might be obvious, but just to be complete.)

So the remaining question: if the Bitlocker protection mechanism is triggered, will the Startupkey still be able to unlock a drive?

At this point I think it would be bad design if you could not, as you cannot differentiate between the key-id's nor the *.bek files. (*.sbek, *.rbek do not exist.) However, I have not been able to validate my assumptions. Nonetheless, I think the dots provide insight.

Related Question