Dec. 8, 2022, 11:57 p.m. | /u/newser21

Computer Forensics www.reddit.com

Let's say a Windows drive is encrypted from within the OS, with "Encrypt used disk space only". Is it possible that some unencrypted data about any of the protectors (like password or recovery password) is left behind?

On an SSD the data usually isn't overwritten if there's free space.

I guess Bitlocker isn't stupid enough to write unencrypted keys to a not-yet-encrypted drive directly. But maybe the keys are in RAM and then they end up in the pagefile? Is …

bitlocker computerforensics key traces unencrypted

Information Security Engineers

@ D. E. Shaw Research | New York City

Embedded Penetration Tester - Cyber Security Team [BGSW]

@ Bosch Group | Warszawa, Poland

Staff Cybersecurity Engineer

@ Torc Robotics | Blacksburg, VA; Remote, US

Cybersecurity Engineer

@ Tiro Solutions Group LLC | Downers Grove, Illinois, United States

Director, Network Compliance

@ Marriott International | Bethesda, MD, United States

Cybersecurity Manager

@ Tiro Solutions Group LLC | Downers Grove, Illinois, United States