Monday, July 7, 2014

Ready, Set, Go.....Format, Encrypt, and Prepare a Removable USB Drive using BitLocker and PowerShell

In my line of work protecting customer data is extremely important, and with that in mind unfortunately some times there is just no way to retrieve data for analysis without using a USB Drive. This presents some important requirements for any removable drive used in this way and for me that includes regularly performing three main tasks:
  1. Format the drive (erase any previous customers data)
  2. Encrypt the drive
  3. Copy any tools etc back onto the drive
So recently I have been working on automating this with PowerShell, through the use of the BitLocker and Storage modules.

Introducing the USB Drive Wipe Prepare project.

What you will need:
  • PowerShell 3+
  • BitLocker Module (recommend at least Windows 8, Windows 2012)

While the complete script can be found here I will focus this post on the challenges I faced with building such solution so that if you are working on a similar project you can benefit from my hard work :)

The most challenging aspect of this was working with Bitlocker CmdLets, so they are my main focus.

The first step is to format the drive with Format-Volume.
$Result = Format-Volume -ObjectId $($Volume.ObjectId) -FileSystem $($Volume.FileSystem) -NewFileSystemLabel $($Volume.FileSystemLabel);

The next step is to encrypt the volume with BitLocker. This involves a number of steps.

  1. Firstly, due to my employers GPO setting (and a best practice) I must add a recovery password key to the drive.
    $Result = Add-BitLockerKeyProtector -MountPoint "$($Volume.DriveLetter):" -RecoveryPasswordProtector
  2. As part of this it is best practice to then make sure you have the Recovery Key saved off to a location. Earlier in the script I create a PSDrive to reference this location and simplify scripting.
    "Bitlocker Key for $($Volume.FileSystemLabel)`r`n `
    Identifier: $((Get-BitLockerVolume "$($Volume.DriveLetter):").KeyProtector.KeyProtectorId)`r`n `Key: $((Get-BitLockerVolume "$($Volume.DriveLetter):").KeyProtector.RecoveryPassword)" | Out-File -FilePath "BitLockerKeys:\$($Volume.FileSystemLabel).BitLockerKey.txt";
  3. Next I enable BitLocker on the Removable Drive with a Password (effectively using BitLocker2Go)
    $Result = Enable-BitLocker -MountPoint "$($Volume.DriveLetter):" -EncryptionMethod Aes256 -UsedSpaceOnly -Password $BitLockerPassword -PasswordProtector;
  4. As the encryption process can take some time the next part of my script checks the status of the protection with
    while ((Get-BitLockerVolume -MountPoint "$($Volume.DriveLetter):").EncryptionPercentage -lt 100)
After encrypting the drive my script then copies files/folders which I have stored in a common path on my laptop for use on most customer engagements. This is a specific need for my line of work however the functionality could be used for anything. I retrieve the path from a XML configuration file during the Begin block of the script, and if that file doesn't exist then it is created. The user can also supply a "-Setup" switch parameter to force the script to prompt for the configuration settings and rebuild the config XML file.

This script is provided "as is" however should you be performing similar operations around Encrypting removable drives this may help you towards your solution.

As mentioned above the complete script can be found on the CodePlex project

Legal Stuff: As always the contents of this blog is provided “as-is”. The information, opinions and views expressed are those of the author and do not necessarily state or reflect those of any other company with affiliation to the products discussed. This includes any URLs or Tools. The author does not accept any responsibility from the use of the information or tools mentioned within this blog, and recommends adequate evaluation against your own requirements to measure suitability.


  1. Thanks for sharing the details!
    i would like to more information from your side!
    please added more then tips!Am working in
    used laptops in hyderabad

  2. Tips for å kjøpe en kopi her. salg kopi eksklusive klokker Folk bruker mye tid på å søke på Internett, der det er mange replikaer av kjente designermerker på salg,copia orologi franck muller og vi kan være sikre på at de er av høy kvalitet og kvalitet.

  3. Invest in an heirloom to cherish forever with a timepiece from the fake cartier watches collection. A fusion of cutting-edge technology and heritage craftsmanship, replica calibre de cartier carbon diver watchesCartier’s fine watches carry the replica calibre de cartier carbon diver watches prestige of the brand’s illustrious history and exceptional quality.

  4. Since 1848,best replica watches Omega watches built a reputation of being the ultimate in luxurious elegance and sporty sophistication. In 1931, the replica omega watches brand entered the Geneva Observatory trials, competing in several categories designed to test the rigor and mechanical reliability of the Omega timepiece. The brand won all six categories and thereby adopted the slogan, "Omega, exact time for life." In 1965, NASA selected Omega to be the official watch used in training and space exploration. A true giant in name and reliability, Omega produces elegant watches that are impervious to changes in fashion. At , we offer a variety of Omega watches for sale — at the lowest prices online. When you are ready to buy an Omega watch, browse our selection that includes the: Seamaster, Speedmaster, 1957 Trilogy, DeVille, Planet Ocean, and Constellation.

  5. International Watch Company, or IWC, was first introduced to the world in 1868 when an American Engineer,replica watches sale Florentine Ariosto Jones, decided to open his own factory in Switzerland. replica IWC watches has earned its reputation as one of the world's finest manufacturers of Swiss luxury watches. IWC only manufactures automatic and manual timepieces which include features such as the chronograph and GMT dual time zone. IWC has definitely made its mark in the world of watches with its dedication to excellence in form and function. Using a range of supplies a large selection of IWC watches at the best sale prices online so buy yours today!

  6. The Audemars Piguet Jules Audemarsreplica watchescollection commemorates one of the brand’s founders. The line is characterized by its traditional and timeless round cases and overall minimalist design. replica audemars piguet watchesHowever, behind the simplicity of these watches is an array of impressive functions, such as tourbillons, moon phases, and chronographs. Designed with both men and women in mind, the Jules Audemars collection fully embodies both the range and restraint of the brand.

  7. Rolex offers a wide range of models from professional to fake rolex watches classic watches to fit any wrist. fake sea dweller watches Choose your favorite model, material, bezel, dial and bracelet, explore the Rolex collection and find the watch that's right for you.