Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Win10 Bitlocker Detects Nonextistent Drive


  • Please log in to reply
3 replies to this topic

#1 raineym

raineym

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 14 March 2017 - 04:17 PM

I work in IT in a corporate environment and we use SCCM to image computers and I have a Lenovo T460 laptop I have imaged with Windows 10 that has a single physical hard drive with a primary partition (C:), a recovery partition, and a BDEDrive partition when the drive was encrypted.

 

Yet, at random intervals, the Bitlocker Drive Encryption pops up and asks if I want to encrypt the D: drive. The laptop has no D: drive. The laptop does not have a CD/DVD/Blu-Ray drive installed. It has several drive mappings to network drives, but none point to D, nor should Bitlocker be detecting those as physical drives.

 

The Bitlocker Drive Encryption pops up about once a day asking to encrypt the drive. I have run several tools trying to detect a "rogue drive" on the machine and each time come up with nothing. No other computer we have ever imaged has had this problem across our network.

 

I  re-imaged the laptop several times before deciding to use it as my everyday laptop so that it did not get distributed out to another user and so that my colleagues and I could work on it and not disturb others while they were working.

 

I have had several colleagues suggest ideas but none have panned out, that is why I am reaching out to a larger community.



BC AdBot (Login to Remove)

 


#2 JohnC_21

JohnC_21

  • Members
  • 24,290 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:04 PM

Posted 14 March 2017 - 04:40 PM

The next time you get the popup open a command prompt and type

 

diskpart

list volume

 

Does diskpart give a size and type for the volume?



#3 raineym

raineym
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 15 March 2017 - 10:33 AM

I've already tried that. This is what I see when I use Diskpart:

 

DISKPART> list volume

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
  Volume 0         BDEDrive     NTFS   Partition    499 MB  Healthy    System
  Volume 1     C   OSDisk       NTFS   Partition    237 GB  Healthy    Boot
  Volume 2                      NTFS   Partition    782 MB  Healthy    Hidden


#4 JohnC_21

JohnC_21

  • Members
  • 24,290 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:04 PM

Posted 15 March 2017 - 11:50 AM

Then I wouldn't have a clue on what drive Bitlocker is trying to encrypt unless is sees volume 2 and is deciding to encrypt it. Is it possible Bitlocker still sees a USB drive as attached?

 

http://orionforensics.com/w_en_page/USB_forensic_tracker.php






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users