如何在Windows上设置BitLocker加密
BitLocker is a tool built into Windows that lets you encrypt an entire hard drive for enhanced security. Here’s how to set it up.
BitLocker是Windows內(nèi)置的工具，可用于加密整個(gè)硬盤驅(qū)動(dòng)器以增強(qiáng)安全性。 設(shè)置方法如下。
When TrueCrypt controversially closed up shop, they recommended their users transition away from TrueCrypt to using BitLocker or Veracrypt. BitLocker has been around in Windows long enough to be considered mature, and is an?encryption product generally well-regarded by security pros. In this article, we’re going to talk about how you can set it up on your PC.
當(dāng)TrueCrypt有爭(zhēng)議的關(guān)閉商店時(shí)，他們建議用戶從TrueCrypt過渡到使用BitLocker或Veracrypt 。 BitLocker在Windows中已經(jīng)存在足夠長的時(shí)間了，可以認(rèn)為它已經(jīng)成熟，并且是安全專業(yè)人員普遍認(rèn)可的加密產(chǎn)品。 在本文中，我們將討論如何在PC上進(jìn)行設(shè)置。
Note: BitLocker Drive Encryption and BitLocker To Go require a Professional or Enterprise edition of Windows 8 or 10, or the Ultimate version of Windows 7. However, starting with Windows 8.1, the Home and Pro editions of Windows include a “Device Encryption” feature?(a feature also included in Windows 10) that works similarly. We recommend Device Encryption if your computer supports it, BitLocker for Pro users who can’t use Device Encryption, and VeraCrypt for people using a Home version of Windows where Device Encryption won’t work.
注意：BitLocker驅(qū)動(dòng)器加密和BitLocker To Go需要Windows 8或10的專業(yè)版或企業(yè)版，或Windows 7的旗艦版。但是，從Windows 8.1開始，Windows的Home和Pro版本包括“設(shè)備加密”功能。 (Windows 10中也包含的功能)的工作原理類似。 如果您的計(jì)算機(jī)支持設(shè)備加密，則建議使用設(shè)備加密；對(duì)于不能使用設(shè)備加密的Pro用戶，請(qǐng)使用BitLocker；對(duì)于使用無法使用設(shè)備加密的Windows Home版本的用戶，建議使用VeraCrypt 。
加密整個(gè)驅(qū)動(dòng)器還是創(chuàng)建加密的容器？ (Encrypt an Entire Drive or Create an Encrypted Container?)
Many guides out there talk about creating a BitLocker container that works much like the kind of encrypted container you can create with products like TrueCrypt or Veracrypt. It’s a bit of a misnomer, but you can achieve a similar effect. BitLocker works by encrypting entire drives. That could be your system drive, a different physical drive, or a virtual hard drive (VHD) that exists as a file and is mounted in Windows.
那里的許多指南都談到創(chuàng)建BitLocker容器，該容器的工作方式與可以使用TrueCrypt或Veracrypt之類的產(chǎn)品創(chuàng)建的加密容器一樣。 這有點(diǎn)用詞不當(dāng)，但是您可以實(shí)現(xiàn)類似的效果。 BitLocker通過加密整個(gè)驅(qū)動(dòng)器來工作。 可能是系統(tǒng)驅(qū)動(dòng)器，其他物理驅(qū)動(dòng)器或文件形式存在并安裝在Windows中的虛擬硬盤(VHD)。
The difference is largely semantic. In other encryption products, you usually create an encrypted container, and then mount it as a drive in Windows when you need to use it. With BitLocker, you create a virtual hard drive, and then encrypt it. If you’d like to use a container rather than, say, encrypt your existing system or storage drive, check out our guide to creating an encrypted container file with BitLocker.
區(qū)別主要是語義上的。 在其他加密產(chǎn)品中，通常創(chuàng)建一個(gè)加密的容器，然后在需要使用時(shí)將其作為驅(qū)動(dòng)器安裝在Windows中。 使用BitLocker，您可以創(chuàng)建一個(gè)虛擬硬盤驅(qū)動(dòng)器，然后對(duì)其進(jìn)行加密。 如果您想使用容器而不是對(duì)現(xiàn)有系統(tǒng)或存儲(chǔ)驅(qū)動(dòng)器進(jìn)行加密，請(qǐng)查閱我們的指南，以使用BitLocker創(chuàng)建加密的容器文件。
For this article, we’re going to concentrate on enabling BitLocker for an existing physical drive.
對(duì)于本文，我們將集中精力為現(xiàn)有物理驅(qū)動(dòng)器啟用BitLocker。
如何使用BitLocker加密驅(qū)動(dòng)器 (How to Encrypt a Drive with BitLocker)
To use BitLocker for a drive, all you really have to do is enable it, choose an unlock method—password, PIN, and so on—and then set a few other options. Before we get into that, however, you should know that using BitLocker’s full-disk encryption on a system drive generally requires a computer with a Trusted Platform Module (TPM) on your PC’s motherboard. This chip generates and store the encryption keys that BitLocker uses. If your PC doesn’t have a TPM, you can use Group Policy to enable using BitLocker without a TPM. It’s a bit less secure, but still more secure than not using encryption at all.
要將BitLocker用于驅(qū)動(dòng)器，您真正要做的就是啟用它，選擇一種解鎖方法(密碼，PIN等)，然后設(shè)置其他一些選項(xiàng)。 但是，在進(jìn)行此討論之前，您應(yīng)該知道，在系統(tǒng)驅(qū)動(dòng)器上使用BitLocker的全盤加密通常需要一臺(tái)計(jì)算機(jī)，該計(jì)算機(jī)在您的PC主板上具有可信平臺(tái)模塊(TPM)。 該芯片生成并存儲(chǔ)BitLocker使用的加密密鑰。 如果您的PC沒有TPM，則可以使用組策略來啟用不帶TPM的BitLocker 。 它的安全性較差，但比根本不使用加密的安全性更高。
You can encrypt a non-system drive or removable drive without TPM and without having to enable the Group Policy setting.
您可以在沒有TPM且無需啟用組策略設(shè)置的情況下加密非系統(tǒng)驅(qū)動(dòng)器或可移動(dòng)驅(qū)動(dòng)器。
On that note, you should also know that there are two types of BitLocker drive encryption you can enable:
關(guān)于這一點(diǎn)，您還應(yīng)該知道可以啟用兩種類型的BitLocker驅(qū)動(dòng)器加密：
BitLocker Drive Encryption:? Sometimes referred to just as BitLocker, this is a “full-disk encryption” feature that encrypts an entire drive. When your PC boots, the Windows boot loader loads from the System Reserved partition, and the boot loader prompts you for your unlock method—for example, a password. BitLocker then decrypts the drive and loads Windows. The encryption is otherwise transparent—your files appear like they normally would on an unencrypted system, but they’re stored on the disk in an encrypted form. You can also encrypt other drives than just the system drive.
BitLocker驅(qū)動(dòng)器加密：有時(shí)也稱為BitLocker，這是對(duì)整個(gè)驅(qū)動(dòng)器進(jìn)行加密的“全盤加密”功能。 當(dāng)您的PC引導(dǎo)時(shí)，Windows引導(dǎo)加載程序?qū)腟ystem Reserved分區(qū)加載，并且引導(dǎo)加載程序提示您輸入解鎖方法(例如，密碼)。 然后，BitLocker解密驅(qū)動(dòng)器并加載Windows。 否則，加密是透明的-您的文件看起來像在未加密的系統(tǒng)上通常一樣，但是以加密形式存儲(chǔ)在磁盤上。 您還可以加密除系統(tǒng)驅(qū)動(dòng)器以外的其他驅(qū)動(dòng)器。
BitLocker To Go: You can encrypt external drives—such as USB flash drives and external hard drives—with BitLocker To Go. You’ll be prompted for your unlock method—for example, a password—when you connect the drive to your computer. If someone doesn’t have the unlock method, they can’t access the files on the drive.
BitLocker To Go ：您可以使用BitLocker To Go加密外部驅(qū)動(dòng)器，例如USB閃存驅(qū)動(dòng)器和外部硬盤驅(qū)動(dòng)器。 將驅(qū)動(dòng)器連接到計(jì)算機(jī)時(shí)，系統(tǒng)會(huì)提示您輸入解鎖方法(例如，密碼)。 如果某人沒有解鎖方法，則他們將無法訪問驅(qū)動(dòng)器上的文件。
In Windows 7 through 10, you really don’t have to worry about making the selection yourself. Windows handles things behind the scenes, and the interface you’ll use to enable BitLocker doesn’t look any different. If you end up unlocking an encrypted drive on Windows XP or Vista, you’ll see the BitLocker to Go branding, so we figured you should at least know about it.
在Windows 7到10中，您實(shí)際上不必?fù)?dān)心自己進(jìn)行選擇。 Windows處理幕后事務(wù)，用于啟用BitLocker的界面看起來沒有什么不同。 如果最終在Windows XP或Vista上解鎖了加密的驅(qū)動(dòng)器，則會(huì)看到BitLocker to Go商標(biāo)，因此我們認(rèn)為您至少應(yīng)該了解這一點(diǎn)。
So, with that out of the way, let’s go over how this actually works.
因此，順便說一句，讓我們回顧一下它的實(shí)際工作原理。
第一步：為驅(qū)動(dòng)器啟用BitLocker (Step One: Enable BitLocker for a Drive)
The easiest way to enable BitLocker for a drive is to right-click the drive in a File Explorer window, and then choose the “Turn on BitLocker” command. If you don’t see this option on your context menu, then you likely don’t have a Pro or Enterprise edition of Windows and you’ll need to seek another encryption solution.
為驅(qū)動(dòng)器啟用BitLocker的最簡(jiǎn)單方法是在“文件資源管理器”窗口中右鍵單擊該驅(qū)動(dòng)器，然后選擇“打開BitLocker”命令。 如果您在上下文菜單中沒有看到此選項(xiàng)，則可能沒有Windows的Pro或Enterprise版本，您將需要尋求其他加密解決方案。
It’s just that simple. The wizard that pops up walks you through selecting several options, which we’ve broken down into the sections that follow.
就這么簡(jiǎn)單。 彈出的向?qū)⒁龑?dǎo)您選擇幾個(gè)選項(xiàng)，我們將其細(xì)分為以下各節(jié)。
第二步：選擇一種解鎖方法 (Step Two: Choose an Unlock Method)
The first screen you’ll see in the “BitLocker Drive Encryption” wizard lets you choose how to unlock your drive. You can select several different ways of unlocking the drive.
您將在“ BitLocker驅(qū)動(dòng)器加密”向?qū)е锌吹降牡谝粋€(gè)屏幕讓您選擇如何解鎖驅(qū)動(dòng)器。 您可以選擇幾種不同的方式來解鎖驅(qū)動(dòng)器。
If you’re encrypting your system drive on a computer that?doesn’t have a TPM, you can unlock the drive with a password or a USB drive that functions as a key. Select your unlock method and follow the instructions for that method (enter a password or plug in your USB drive).
如果要在沒有TPM的計(jì)算機(jī)上加密系統(tǒng)驅(qū)動(dòng)器，則可以使用密碼或用作密鑰的USB驅(qū)動(dòng)器來解鎖驅(qū)動(dòng)器。 選擇解鎖方法，然后按照該方法的說明進(jìn)行操作(輸入密碼或插入U(xiǎn)SB驅(qū)動(dòng)器)。
If your computer does have a TPM, you’ll see additional options for unlocking your system drive. For example, you can configure automatic unlocking at startup (where your computer grabs the encryption keys from the TPM and automatically decrypts the drive). You could also?use a PIN instead of a password, or even choose biometric options like a fingerprint.
如果您的計(jì)算機(jī)確實(shí)有TPM，則將看到用于解鎖系統(tǒng)驅(qū)動(dòng)器的其他選項(xiàng)。 例如，您可以配置啟動(dòng)時(shí)自動(dòng)解鎖(您的計(jì)算機(jī)從TPM獲取加密密鑰并自動(dòng)解密驅(qū)動(dòng)器)。 您也可以使用PIN代替密碼，甚至可以選擇指紋等生物識(shí)別選項(xiàng)。
If you’re encrypting a non-system drive or removable drive, you’ll see only two options (whether you have a TPM or not). You can unlock the drive with a password or a smart card (or both).
如果您要加密非系統(tǒng)驅(qū)動(dòng)器或可移動(dòng)驅(qū)動(dòng)器，則只會(huì)看到兩個(gè)選項(xiàng)(是否有TPM)。 您可以使用密碼或智能卡(或同時(shí)使用兩者)解鎖驅(qū)動(dòng)器。
第三步：備份恢復(fù)密鑰 (Step Three: Back Up Your Recovery Key)
BitLocker provides you with a recovery key that you can use to access your encrypted files should you ever lose your main key—for example, if you forget your password or if the PC with TPM dies and you have to access the drive from another system.
BitLocker為您提供了一個(gè)恢復(fù)密鑰，如果您丟失了主密鑰，則可以使用該密鑰來訪問加密的文件，例如，如果您忘記了密碼或具有TPM的PC死了，并且必須從另一個(gè)系統(tǒng)訪問驅(qū)動(dòng)器。
You can save the key to your Microsoft account, a USB drive, a file, or even print it. These options are the same whether you’re encrypting a system or non-system drive.
您可以將密鑰保存到您的Microsoft帳戶，USB驅(qū)動(dòng)器，文件，甚至進(jìn)行打印。 無論您要加密系統(tǒng)驅(qū)動(dòng)器還是非系統(tǒng)驅(qū)動(dòng)器，這些選項(xiàng)都是相同的。
If you back up the recovery key to your Microsoft account, you can access the key later at https://onedrive.live.com/recoverykey. If you use another recovery method, be sure to keep this key safe—if someone gains access to it, they could decrypt your drive and bypass encryption.
如果將恢復(fù)密鑰備份到您的Microsoft帳戶，則可以稍后在https://onedrive.live.com/recoverykey上訪問該密鑰。 如果您使用其他恢復(fù)方法，請(qǐng)確保妥善保存此密鑰-如果有人可以訪問它，則他們可以解密您的驅(qū)動(dòng)器并繞過加密。
You can also back up your recovery key multiple ways if you want. Just click each option you want to use in turn, and then follow the directions. When you’re done saving your recovery keys, click “Next” to move on.
您還可以根據(jù)需要以多種方式備份恢復(fù)密鑰。 只需依次單擊要使用的每個(gè)選項(xiàng)，然后按照說明進(jìn)行操作。 保存完恢復(fù)密鑰后，請(qǐng)單擊“下一步”繼續(xù)。
Note: If you’re encrypting a USB or other removable drive, you won’t have the option of saving your recovery key to a USB drive. You can use any of the other three options.
注意：如果您要加密USB或其他可移動(dòng)驅(qū)動(dòng)器，則無法選擇將恢復(fù)密鑰保存到USB驅(qū)動(dòng)器。 您可以使用其他三個(gè)選項(xiàng)中的任何一個(gè)。
第四步：加密和解鎖驅(qū)動(dòng)器 (Step Four: Encrypt and Unlock the Drive)
BitLocker automatically encrypts new files as you add them, but you must choose what happens with the files currently on your drive. You can encrypt the entire drive—including the free space—or just encrypt the used disk files to speed up the process. These options are also the same whether?you’re encrypting a system or non-system drive.
添加新文件時(shí)，BitLocker會(huì)自動(dòng)對(duì)其進(jìn)行加密，但是您必須選擇驅(qū)動(dòng)器上當(dāng)前文件的處理方式。 您可以加密整個(gè)驅(qū)動(dòng)器(包括可用空間)，也可以僅加密使用的磁盤文件以加快處理速度。 無論您要加密系統(tǒng)驅(qū)動(dòng)器還是非系統(tǒng)驅(qū)動(dòng)器，這些選項(xiàng)都相同。
If you’re setting up BitLocker on a new PC, encrypt the used disk space only—it’s much faster. If you’re setting BitLocker up on a PC you’ve been using for a while, you should encrypt the entire drive to ensure no one can recover deleted files.
如果要在新PC上設(shè)置BitLocker，則僅加密使用的磁盤空間-速度要快得多。 如果您在已經(jīng)使用了一段時(shí)間的PC上設(shè)置BitLocker，則應(yīng)加密整個(gè)驅(qū)動(dòng)器，以確保沒有人可以恢復(fù)已刪除的文件。
When you’ve made your selection, click the “Next” button.
做出選擇后，單擊“下一步”按鈕。
第五步：選擇加密模式(僅Windows 10) (Step Five: Choose an Encryption Mode (Windows 10 Only))
If you’re using Windows 10, you’ll see an additional screen letting you choose an encryption method. If you’re using Windows 7 or 8, skip ahead to the next step.
如果您使用的是Windows 10，則會(huì)看到一個(gè)額外的屏幕，供您選擇加密方法。 如果您使用的是Windows 7或8，請(qǐng)?zhí)较乱徊健?/p>
Windows 10 introduced a new encryption method named XTS-AES. It provides enhanced integrity and performance over the AES used in Windows 7 and 8. If you know the drive you’re encrypting is only going to be used on Windows 10 PCs, go ahead and choose the “New encryption mode” option. If you think you might need to use the drive with an older version of Windows at some point (especially important if it’s a removable drive), choose the “Compatible mode” option.
Windows 10引入了一種名為XTS-AES的新加密方法。 與Windows 7和8中使用的AES相比，它提供了增強(qiáng)的完整性和性能。如果您知道要加密的驅(qū)動(dòng)器僅在Windows 10 PC上使用，請(qǐng)繼續(xù)并選擇“新加密模式”選項(xiàng)。 如果您認(rèn)為某個(gè)時(shí)候可能需要將該驅(qū)動(dòng)器與舊版本的Windows一起使用(如果是可移動(dòng)驅(qū)動(dòng)器，則尤其重要)，請(qǐng)選擇“兼容模式”選項(xiàng)。
Whichever option you choose (and again, these are the same for system and non-system drives), go ahead and click the “Next” button when you’re done, and on the next screen, click the “Start Encrypting” button.
無論選擇哪個(gè)選項(xiàng)(同樣，系統(tǒng)驅(qū)動(dòng)器和非系統(tǒng)驅(qū)動(dòng)器都是相同的)，請(qǐng)繼續(xù)并在完成后單擊“下一步”按鈕，然后在下一個(gè)屏幕上單擊“開始加密”按鈕。
第六步：完成 (Step Six: Finishing Up)
The encryption process can take anywhere from seconds to minutes or even longer, depending on the size of the drive, the amount of data you’re encrypting, and whether you chose to encrypt free space.
加密過程可能需要幾秒鐘到幾分鐘甚至更長的時(shí)間，具體取決于驅(qū)動(dòng)器的大小，要加密的數(shù)據(jù)量以及是否選擇加密可用空間。
If you’re encrypting your system drive, you’ll be prompted to run a BitLocker system check and restart your system. Make sure the option is selected, click the “Continue” button, and then restart your PC when asked.?After the PC boots back up for the first time, Windows encrypts the drive.
如果要加密系統(tǒng)驅(qū)動(dòng)器，系統(tǒng)將提示您運(yùn)行BitLocker系統(tǒng)檢查并重新啟動(dòng)系統(tǒng)。 確保選擇了該選項(xiàng)，單擊“繼續(xù)”按鈕，然后在出現(xiàn)提示時(shí)重新啟動(dòng)PC。 PC首次啟動(dòng)后，Windows會(huì)加密驅(qū)動(dòng)器。
If you’re encrypting a non-system or removable drive, Windows does not need to restart and encryption begins immediately.
如果您要加密非系統(tǒng)驅(qū)動(dòng)器或可移動(dòng)驅(qū)動(dòng)器，則Windows不需要重新啟動(dòng)，加密會(huì)立即開始。
Whatever type of drive you’re encrypting, you can check the BitLocker Drive Encryption icon in the system tray to see its progress, and you can continue using your computer while drives are being encrypted—it will just perform more slowly.
無論您要加密哪種類型的驅(qū)動(dòng)器，都可以檢查系統(tǒng)托盤中的BitLocker驅(qū)動(dòng)器加密圖標(biāo)以查看其進(jìn)度，并且可以在加密驅(qū)動(dòng)器的同時(shí)繼續(xù)使用計(jì)算機(jī)-它的運(yùn)行速度會(huì)更慢。
解鎖驅(qū)動(dòng)器 (Unlocking Your Drive)
If your system drive is encrypted, unlocking it depends on the method you chose (and whether your PC has a TPM). If you do have a TPM and elected to have the drive unlocked automatically, you won’t notice anything different—you’ll just boot straight into Windows like always. If you chose another unlock method, Windows prompts you to unlock the drive (by typing your password, connecting your USB drive, or whatever).
如果您的系統(tǒng)驅(qū)動(dòng)器是加密的，則對(duì)其進(jìn)行解鎖取決于您選擇的方法(以及您的PC是否具有TPM)。 如果您確實(shí)有TPM并選擇了自動(dòng)解鎖驅(qū)動(dòng)器，則不會(huì)發(fā)現(xiàn)任何不同-您將像往常一樣直接啟動(dòng)進(jìn)入Windows。 如果您選擇了另一種解鎖方法，Windows會(huì)提示您解鎖驅(qū)動(dòng)器(通過輸入密碼，連接USB驅(qū)動(dòng)器或其他方法)。
And if you’ve lost (or forgotten) your unlock method, press Escape on the prompt screen to enter your recovery key.
并且，如果您丟失(或忘記了)解鎖方法，請(qǐng)?jiān)谔崾酒聊簧习碋scape輸入恢復(fù)密鑰。
If you’ve encrypted a non-system or removable drive, Windows prompts you to unlock the drive when you first access it after starting Windows (or when you connect it to your PC if it’s a removable drive). Type your password or insert your smart card, and the drive should unlock so you can use it.
如果您已經(jīng)加密了非系統(tǒng)驅(qū)動(dòng)器或可移動(dòng)驅(qū)動(dòng)器，則在啟動(dòng)Windows后首次訪問該驅(qū)動(dòng)器時(shí)(或者如果它是可移動(dòng)驅(qū)動(dòng)器，則將其連接到PC上)，Windows會(huì)提示您解鎖該驅(qū)動(dòng)器。 輸入密碼或插入智能卡，驅(qū)動(dòng)器將解鎖，以便您可以使用它。
In File Explorer, encrypted drives show a gold lock on the icon (on the left). That lock changes to gray and appears unlocked when you unlock the drive (on the right).
在“文件資源管理器”中，加密的驅(qū)動(dòng)器在圖標(biāo)(左側(cè))上顯示金鎖。 當(dāng)您解鎖驅(qū)動(dòng)器時(shí)(右側(cè))，該鎖定將變?yōu)榛疑@示為未鎖定。
You can manage a locked drive—change the password, turn off BitLocker, back up your recovery key, or perform other actions—from the BitLocker control panel window. Right-click any encrypted drive, and then select “Manage BitLocker” to go directly to that page.
您可以從BitLocker控制面板窗口中管理鎖定的驅(qū)動(dòng)器-更改密碼，關(guān)閉BitLocker，備份恢復(fù)密鑰或執(zhí)行其他操作。 右鍵單擊任何加密的驅(qū)動(dòng)器，然后選擇“管理BitLocker”以直接轉(zhuǎn)到該頁面。
Like all encryption, BitLocker does add some overhead. Microsoft’s official BitLocker FAQ says that “Generally it imposes a single-digit percentage performance overhead.” If encryption is important to you because you have sensitive data—for example, a laptop full of business documents—the enhanced security is well worth the performance trade-off.
與所有加密一樣，BitLocker確實(shí)會(huì)增加一些開銷。 微軟官方的BitLocker常見問題解答說：“通常，它會(huì)帶來百分之幾的性能開銷。” 如果加密對(duì)您很重要，因?yàn)槟鷵碛忻舾袛?shù)據(jù)(例如，裝有業(yè)務(wù)文檔的筆記本電腦)，那么增強(qiáng)的安全性就值得在性能上進(jìn)行權(quán)衡。
翻譯自: https://www.howtogeek.com/192894/how-to-set-up-bitlocker-encryption-on-windows/
創(chuàng)作挑戰(zhàn)賽新人創(chuàng)作獎(jiǎng)勵(lì)來咯，堅(jiān)持創(chuàng)作打卡瓜分現(xiàn)金大獎(jiǎng)總結(jié)
以上是生活随笔為你收集整理的如何在Windows上设置BitLocker加密的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問題。
- 上一篇： 如何在Outlook 2013中管理附件
- 下一篇： 如何在Windows 10上限制Wi