Splitting my encrypted C: drive into two partitions

dbookbinder · Mar 18, 2024

My C: drive is a 2TB SSD encrypted with Bitlocker. I want to split it into two partitions and move my data files to the second partition so that creating a boot image is less time consuming -- currently it takes all night. I separately back up the data files incrementally, so I don't need these to be in the disk image.

I have several related questions:

Can I do this without decrypting the C: drive using something like Minitool or EASUS partition managers?
If I don't have to decrypt, should I suspend Bitlocker while the repartitioning is happening?
After the split, will each partition be encrypted, or do I need to re-encrypt the new second partition?
Will the second partition have a different encryption key?
I also have a second internal drive. Will the second partition become D: and the second internal drive E:?

I'm running Windows 11 Pro, 23H2.
Thanks!

Berton · Mar 18, 2024

My experience on a clients computer?
1, 2, 3 eliminate all encryption,
4 maybe,
5 disconnect any other drive/s first.

Not listed, keep in mind that if one partition fails the whole drive may be having issues, may fail. I prefer my 8TB NAS drive running as RAID 1 with 2 x 4TB HDDs for 4TB total storage.

Ghot · Mar 18, 2024

@dbookbinder

Definitely decrypt first.
You don't have to unhook the other drives, just to partition.
You can change the drive letters to whatever you want... afterwards. With Minitool or Disk Management.

You can easily go all OCD with drive letters... if desired.

This is my Disk Management, and File Explorer...

I only backup the stuff in the RED box, in the top pic. Approx. 35GB. Takes just under two minutes.

barreleye · Mar 18, 2024

dbookbinder said:
My C: drive is a 2TB SSD encrypted with Bitlocker. I want to split it into two partitions and move my data files to the second partition so that creating a boot image is less time consuming -- currently it takes all night. I separately back up the data files incrementally, so I don't need these to be in the disk image.

I have several related questions:
Can I do this without decrypting the C: drive using something like Minitool or EASUS partition managers?

If I could follow Microsoft instructions to use Windows diskpart to shrink my Bitlockered system partition to make room for a larger recovery partition, you should be able to do the same to make room for a new partition. The Windows Disk Management app might also do the trick.

If I don't have to decrypt, should I suspend Bitlocker while the repartitioning is happening?

No.

After the split, will each partition be encrypted, or do I need to re-encrypt the new second partition?

The new partition won't be encrypted.

Will the second partition have a different encryption key?

Yes, and it will be a data drive, so you should enable auto-unlock after you encrypt it. This has implications when you restore the OS partition. This article explains different ways to backup/restore Bitlockered OS partitions for the imaging software I use, but it applies to all such software:

Using BitLocker with TeraByte’s Imaging Programs – TeraByte Knowledge Base

www.terabyteunlimited.com

This article explains how to recover when you mess up and restore the OS partition in the unencrypted state, such that you have to re-encrypt it, which screws up auto-unlock:

Re-enable BitLocker Auto-Unlock after System Volume Restore | MCB Systems

Today I did a disaster recovery test on my Windows Server 2008 R2 Hyper-V host. I used Windows Backup to do a bare metal restore of only the system volume. As expected, after the restore, the system volume was no longer encrypted. But even after re-encrypting the system volume, I was unable to...

www.mcbsys.com

I also have a second internal drive. Will the second partition become D: and the second internal drive E:?

No, the drive letters won't change for fixed drives.

glasskuter · Mar 19, 2024

My 2 cents, if my drive was encrypted (it's not) I would never take the chance and perform disk tasks without decrypting and turning off bitlocker first.

ThrashZone · Mar 19, 2024

Hi,
Personally the 2tb ssd is best used as a pure personal data/ games drive
If it were me I'd look into getting a 250-500gb ssd just for os

But indeed decrypt first.

markw51 · Mar 19, 2024

I've never decrypted when shrinking C: and creating new partitions using disk management. It shrinks fine and when I format the new simple partition it is automatically encrypted.

dbookbinder · Mar 19, 2024

markw51 said:
I've never decrypted when shrinking C: and creating new partitions using disk management. It shrinks fine and when I format the new simple partition it is automatically encrypted.

There seem to be widely divergent views on this. Good to hear you've had no problems. When it's automatically encrypted, does it use the same encryption key or a new one for that partition?

glasskuter · Mar 19, 2024

dbookbinder said:
There seem to be widely divergent views on this

Most around here believe an ounce of prevention is worth a pound of cure.

markw51 · Mar 19, 2024

dbookbinder said:
There seem to be widely divergent views on this. Good to hear you've had no problems. When it's automatically encrypted, does it use the same encryption key or a new one for that partition?

Same one

barreleye · Mar 19, 2024

dbookbinder said:
There seem to be widely divergent views on this. Good to hear you've had no problems. When it's automatically encrypted, does it use the same encryption key or a new one for that partition?

To those who say the newly formatted partition will be automatically encrypted, are you using "Device Encryption"? That's different than regular Bitlocker and unavailable on my Windows 11 Pro 23H2 system, which is the same OS the OP says he's running. From what I've just read, "Device Encryption" is indeed automatic for OS and fixed drives. Regular Bitlocker, OTOH, is not. At least I've always had to manually enable it on every volume I want encrypted, which is all of them, and this goes back to when I moved from Truecrypt to Bitlocker in 2014. That said, I've never partitioned a drive aside from re-creating and enlarging the recovery volume to apply the recent updates. I don't have direct experience with creating a normal data partition on an OS drive, and I would be surprised if regular Bitlocker automatically encrypts it just because the OS partition is encrypted. That definitely does not happen with separate data drives.

markw51 · Mar 19, 2024

barreleye said:
To those who say the newly formatted partition will be automatically encrypted, are you using "Device Encryption"? That's different than regular Bitlocker and unavailable on my Windows 11 Pro 23H2 system, which is the same OS the OP says he's running. From what I've just read, "Device Encryption" is indeed automatic for OS and fixed drives. Regular Bitlocker, OTOH, is not. At least I've always had to manually enable it on every volume I want encrypted, which is all of them, and this goes back to when I moved from Truecrypt to Bitlocker in 2014. That said, I've never partitioned a drive aside from re-creating and enlarging the recovery volume to apply the recent updates. I don't have direct experience with creating a normal data partition on an OS drive, and I would be surprised if regular Bitlocker automatically encrypts it just because the OS partition is encrypted. That definitely does not happen with separate data drives.

No, I have Bitlocker on all my partitions and when I created two new partitions, one for my documents which is NTFS and one for my DevDrive which is ReFS they both had Bitlocker enabled straight away.

barreleye · Mar 19, 2024

markw51 said:
No, I have Bitlocker on all my partitions and when I created two new partitions, one for my documents which is NTFS and one for my DevDrive which is ReFS they both had Bitlocker enabled straight away.

Well, either you're using Device Encryption, or your system behaves differently than mine for unknown reasons. Using Disk Management, I just tried shrinking my Bitlockered C: drive and created a new partition right after it, and after formatting the new partition, it was not encrypted. IOW, the new partition on the OS drive is treated exactly the same as a separate drive, which is what I thought would happen.

markw51 · Mar 19, 2024

barreleye said:
Well, either you're using Device Encryption, or your system behaves differently than mine for unknown reasons. Using Disk Management, I just tried shrinking my Bitlockered C: drive and created a new partition right after it, and after formatting the new partition, it was not encrypted. IOW, the new partition on the OS drive is treated exactly the same as a separate drive, which is what I thought would happen.

Definitely Bitlocker

barreleye · Mar 19, 2024

markw51 said:
Definitely Bitlocker View attachment 90808

I don't know if that's the right place to look. Device Encryption uses Bitlocker but is a higher-level construct, and I wouldn't be surprised if that dialog box I'm very familiar with doesn't give information about the former. Go to "Settings > Privacy & security" and see what's under the "Security" section at the top. If your device supports "Device Encryption", there will be an option for it there, and you can click on it to see if you're using it:

Turn On or Off Device Encryption in Windows 11 Tutorial

This tutorial will show you how to turn on or off device encryption on a Windows 11 PC. Device encryption (aka: BitLocker automatic device encryption) helps protect your data on the OS drive, and it's available on a wide range of Windows devices. If you turn on device encryption, the OS drive...

www.elevenforum.com

Neither of my Windows 11 Pro systems has the option for "Device Encryption". Don't know why, and in fact, I'd never heard of it before reading these posts talking about "automatic encryption", which I've never experienced in 10 years of using Bitlocker on probably a couple dozen drives.

markw51 · Mar 19, 2024

barreleye said:
I don't know if that's the right place to look. Device Encryption uses Bitlocker but is a higher-level construct, and I wouldn't be surprised if that dialog box I'm very familiar with doesn't give information about the former. Go to "Settings > Privacy & security" and see what's under the "Security" section at the top. If your device supports "Device Encryption", there will be an option for it there, and you can click on it to see if you're using it:

Turn On or Off Device Encryption in Windows 11 Tutorial

This tutorial will show you how to turn on or off device encryption on a Windows 11 PC. Device encryption (aka: BitLocker automatic device encryption) helps protect your data on the OS drive, and it's available on a wide range of Windows devices. If you turn on device encryption, the OS drive...

www.elevenforum.com

Neither of my Windows 11 Pro systems has the option for "Device Encryption". Don't know why, and in fact, I'd never heard of it before reading these posts talking about "automatic encryption", which I've never experienced in 10 years of using Bitlocker on probably a couple dozen drives.

I have this and when I click on BitLocker drive encryption it takes me to the screen shot I posted earlier.

markw51 · Mar 19, 2024

I also have a Samsung NVME SSD which has had encrypted drive enabled by Samsung Magician which utilises hardware encryption.

TraderGary · Mar 19, 2024

markw51 said:
I also have a Samsung NVME SSD which has had encrypted drive enabled by Samsung Magician which utilises hardware encryption.

I'm a longtime BitLocker user. I have several Samsung SSD drives that came with Samsung Magician installed. When I get them, I format them and then install BitLocker.

barreleye · Mar 19, 2024

markw51 said:
I have this and when I click on BitLocker drive encryption it takes me to the screen shot I posted earlier.

So, as I suspected, you're using "Device Encryption", and that's why you're getting automatic encryption. If Device Encryption isn't enabled for whatever reason, you don't get automatic encryption, but you can still use Bitlocker directly, which is what I've always done.

markw51 said:
I also have a Samsung NVME SSD which has had encrypted drive enabled by Samsung Magician which utilises hardware encryption.

Microsoft stopped trusting self-encrypting drives five years ago:

Microsoft Stops Trusting SSD Makers

Microsoft updated BitLocker to encrypt all SSDs, even those that claim to encrypt themselves, so it can help Windows users remain secure.

www.tomshardware.com

You can use "manage-bde -status" to see if you're using hardware or software encryption. I never wanted to multiply vulnerabilities so never trusted the individual hardware manufacturers anyway and always used software encryption.