Solved New 500GB NVMe Gen.4 SSD encrypted by ASUS.

FrankW · Jul 28, 2023

My new Vivobook laptop boot drive is encrypted but not protected with a password. I have no security concerns, only use the laptop at home, no one else has access to it. Should I decrypt the drive or just leave it encrypted? Is encrypting slowing down this fast SSD (NVMe Micron_2450_MTFDKBA512TFK)? When I clicked on decrypt, I got a red warning that this may take very long (150GB data) and I read on the website that it may even take days, so I cancelled. I asked ASUS Support why they encrypt drives (factory default) but did not get a reply. All comments appreciated.

Bastet · Jul 28, 2023

If you’re not going to use the feature then you can turn it off/decrypt the drive.
Many pcs running Home now have some form of encryption software via the manufacturer judging by the people who post on the MS community.
I would save the backup key to decrypt the drive beforehand though just in case of problems (if there is one).

rockyanexp · Jul 28, 2023

You can decrypt. It wont take more than afew mins.
And encrypted device dont take much cpu cycles.

echo2446 · Jul 29, 2023

The system encryption can generally improve security for the system at rest, at the cost of negligible CPU cycles and a possibility of losing the entire drive's content if a recovery method is not kept safe religiously.
Unencrypted SSD drive moderately increases the chance of your "deleted" data being recovered. If you have drive encryption, the drive (SSD or not) can generally be thrown away without doing anything to destroy the data, deleted or not.

I personally would drive-encrypt all SSD drives including the system drive, and keep the recovery keys safe and accessible.

windoc · Jul 30, 2023

Encrypting your drive, even if you only use your laptop at home, adds an additional layer of security. The main purpose of drive encryption is to protect the data on your drive from unauthorized access in case your laptop gets lost or stolen. Encryption makes it incredibly difficult for someone to access your data without the encryption key.

As for performance, modern SSDs (especially NVMe drives like your Micron_2450_MTFDKBA512TFK) and CPUs are well-equipped to manage encryption and decryption tasks without any noticeable performance loss for most users. The performance impact of drive encryption has been significantly reduced with modern hardware. Even on older systems, the impact was typically less than 10%, and on newer systems, it is often even less noticeable. This is due to features such as Intel's AES-NI instruction set that are built into modern CPUs to accelerate encryption and decryption tasks.

As for why your ASUS Vivo book came with an encrypted drive, it is part of a trend towards more secure defaults. Many computer manufacturers are now shipping their devices with encryption enabled to better protect their customers' data.

Decryption could indeed take some time (not days for 150GB, but possibly several hours), and during this process, you will want to ensure that the laptop has a constant power source to avoid any potential data corruption.

Fabler2 · Jul 30, 2023

Don't understand (never used bitlocker) but what's the point encrypting a drive without a password?

windoc · Jul 30, 2023

Fabler2 said:
Don't understand (never used bitlocker) but what's the point encrypting a drive without a password?

In the OP's scenario, the boot drive is indeed encrypted and decrypted using a private key stored in the Trusted Platform Module (TPM). The TPM is used to securely store the encryption key, which is released during the boot process and does not directly depend on user login. The key unseals only if the early boot files and boot configuration data remain unaltered, thus validating the integrity of the boot process.

Fabler2 · Jul 30, 2023

windoc said:
In the OP's scenario, the boot drive is indeed encrypted and decrypted using a private key stored in the Trusted Platform Module (TPM). The TPM is used to securely store the encryption key, which is released during the boot process and does not directly depend on user login. The key unseals only if the early boot files and boot configuration data remain unaltered, thus validating the integrity of the boot process.

Thanks for the explanation. It makes sense. So, say the laptop's motherboard dies suddenly, you then can't take data off the drive when it's connected to a new machine then?

windoc · Jul 30, 2023

Fabler2 said:
Thanks for the explanation. It makes sense. So, say the laptop's motherboard dies suddenly, you then can't take data off the drive when it's connected to a new machine then?

If you don't have a backup copy of the key and the laptop's motherboard, specifically the Trusted Platform Module (TPM), fails, it will be extremely difficult to recover data from an encrypted drive. The TPM is where the encryption key is securely stored, and it is paired to that specific system. If the motherboard or TPM dies, you generally lose access to that key. This means the data on the drive can't be decrypted

Fabler2 · Jul 30, 2023

windoc said:
If you don't have a backup copy of the key and the laptop's motherboard, specifically the Trusted Platform Module (TPM), fails, it will be extremely difficult to recover data from an encrypted drive. The TPM is where the encryption key is securely stored, and it is paired to that specific system. If the motherboard or TPM dies, you generally lose access to that key. This means the data on the drive can't be decrypted

This is where I'm confused with the OP mentioning no password rather than the key. So if your drive is encrypted you should make sure you have a backup of the key in your Microsoft account otherwise you've lost all the data if anything happens to the PC?

Dru2 · Jul 30, 2023

I see zero reason to decrypt an already encrypted drive. This is a security feature I would think people would want on their portable devices, such as a laptop. I certainly do one mine.

As for decryption key, the key is built into the system so when the PC is logged into properly there the drive is unlocked. No issues there.

Performance wise I highly doubt there is a huge dip between encrypted and unencrypted.

And BTW, I actually do use BitLocker. And my Lenovo laptop is also encrypted. No issues here.

Dru2 · Jul 30, 2023

Fabler2 said:
This is where I'm confused with the OP mentioning no password rather than the key. So if your drive is encrypted you should make sure you have a backup of the key in your Microsoft account otherwise you've lost all the data if anything happens to the PC?

If the OP has a Microsoft account, and logs into the machine with it, I'd bet that's where the key got stored.

Fabler2 · Jul 30, 2023

Dru2 said:
If the OP has a Microsoft account, and logs into the machine with it, I'd bet that's where the key got stored.

That's what I wanted to know if it is done automatically. If these OEMs encrypt the drive automatically will less experienced users know about it and what it entails. Do they actually notify the new user ?

Dru2 · Jul 30, 2023

Fabler2 said:
That's what I wanted to know if it is done automatically. If these OEMs encrypt the drive automatically will less experienced users know about it and what it entails. Do they actually notify the new user ?

The user probably isn't aware unless they're aware new laptops come with encrypted drives. Usually, the spec sheet may mention the drive is encrypted as more of a "these are the security features" of your shiny new laptop

Typically, with laptops there's zero reason to worry about drive encryption as it's a background thing and doesn't interfere with anything. The only people who need to worry about it are those trying to get into the laptop illegally.... aka a stolen laptop

Edit: As far as knowing where the find the encryption key is, first look towards the MS account. The other is to ask the vendor. Regardless the key will be married to the laptop so and why it's never required when accessing the drive legally.

windoc · Jul 30, 2023

Fabler2 said:
This is where I'm confused with the OP mentioning no password rather than the key. So if your drive is encrypted you should make sure you have a backup of the key in your Microsoft account otherwise you've lost all the data if anything happens to the PC?

If you are using a Home version of Windows, and logged into your Microsoft account it will automatically back up your key. You don't have a choice. You cannot do a manual backup.

If you are using a Pro, Education, or Enterprise version of Windows, you will be given a choice during set up to back up the key to Microsoft, or to perform a manual backup to a USB drive.

Fabler2 · Jul 30, 2023

Dru2 said:
The user probably isn't aware unless they're aware new laptops come with encrypted drives. Usually, the spec sheet may mention the drive is encrypted as more of a "these are the security features" of your shiny new laptop

Typically, with laptops there's zero reason to worry about drive encryption as it's a background thing and doesn't interfere with anything. The only people who need to worry about it are those trying to get into the laptop illegally.... aka a stolen laptop

Yes that's obvious. My question is, if the drive is encrypted automatically is the key backup also generated automatically? Having a backup of the key must be as important.

Fabler2 · Jul 30, 2023

windoc said:
If you are using a Home version of Windows, and logged into your Microsoft account it will automatically back up your key. You don't have a choice. You cannot do a manual backup.

If you are using a Pro, Education, or Enterprise version of Windows, you will be given a choice during set up to back up the key to Microsoft, or to perform a manual backup to a USB drive.

Posting at the same time. Thanks, that answered my question. :thumbsup:

Dru2 · Jul 30, 2023

windoc said:
If you are using a Home version of Windows, and logged into your Microsoft account it will automatically back up your key. You don't have a choice. You cannot do a manual backup.

If you are using a Pro, Education, or Enterprise version of Windows, you will be given a choice during set up to back up the key to Microsoft, or to perform a manual backup to a USB drive.

Where consumer laptops are concerned (and none I know of being sold with Education, or Enterprise versions of Windows... unless specifically requested) .... Regardless of OS, the key will be backed up when first logged into the PC via Microsoft account. I've two laptops (Asus, Lenovo) both shipped with "Pro" versions of Windows, and this is how it was.

Dru2 · Jul 30, 2023

Fabler2 said:
Yes that's obvious. My question is, if the drive is encrypted automatically is the key backup also generated automatically? Having a backup of the key must be as important.

If the drive was encrypted when you bought the laptop wouldn't there be a decryption key?

Thus, the question would not be is there a key, but where is said key. And that I believe I answered

Fabler2 · Jul 30, 2023

Found this,

Why Microsoft stores your Windows Device Encryption Key to OneDrive

Microsoft automatically encrypts your new Windows device & stores the encryption key on OneDrive, when you sign in using your Microsoft Account. Learn how to delete this key and generate your own.

www.thewindowsclub.com

Interestingly on this laptop had Home initially installed then upgraded to Pro. Never used Bitlocker but keys still generated. Have one generated for Home and two for Pro. I suspect because I'm dual booting. Interestingly a date showing 2013 must be from a now defunct machine long gone to the recycling bin.
Edit: Those two drives showing for this laptop is for Removal Drive Volumes. I encrypted two Flash drives previously so it even keeps a copy for those external drives. That's good.