Understanding bitlocker conversion status

hershey4 · Jul 7, 2026

Got a new computer and was thinking backing up encryption key would be a good idea, but a little investigation, I guess the default is that the drive is not encrypted. But what does conversion status mean below? Control panel status shows "waiting for activation" with an option to turn on bitlocker. But that status is a little contradictory, isn't it?

Also, is it true that if it is turned on, that's when a key is generated? Does it present a key at that time to save? My PC runs only on a Local Account so it won't end up in my MS account. (unless it requires MS sign in... I wouldn't think so though).

Volume C: [OS]
[OS Volume]

Size: 364.60 GB
BitLocker Version: 2.0
Conversion Status: Used Space Only Encrypted
Percentage Encrypted: 100.0%
Encryption Method: XTS-AES 128
Protection Status: Protection Off
Lock Status: Unlocked
Identification Field: Unknown
Key Protectors:
Numerical Password

Volume W: [MYDATA]
[Data Volume]

Size: 439.45 GB
BitLocker Version: 2.0
Conversion Status: Used Space Only Encrypted
Percentage Encrypted: 100.0%
Encryption Method: XTS-AES 128
Protection Status: Protection Off
Lock Status: Unlocked
Identification Field: Unknown
Automatic Unlock: Disabled
Key Protectors: None Found

echo2446 · Jul 7, 2026

hershey4 said:
But what does conversion status mean below?

It means all the space with the data is already encrypted. But since the Protection is "Off", Bitlocker stores the decryption key openly on the drive. You just need to turn the protection on (and back up the key).

Marie SWE · Jul 7, 2026

echo2446 said:
It means all the space with the data is already encrypted. But since the Protection is "Off", Bitlocker stores the decryption key openly on the drive. You just need to turn the protection on (and back up the key).

So if you get a nasty OS failure or malware or a disk failure that sabotage the OS so you losing system folders/files.. the data is then unreachable as its encrypted if the key was on that space that got destroyed.... In theory

So if you dont want bitlocker, it sounds as you need to first enable it and then disable it again so it decrypt the data.

glasskuter · Jul 7, 2026

The "BitLocker waiting for activation" status means your drive is partially encrypted by Windows, but no recovery key or key protector has been backed up. To fix it, either fully complete the encryption process or disable it completely to remove the warning.

If one uses Windows Home, automatic Device Encryption requires a Microsoft account to back up the recovery key.

ISince you have Windows Pro you can manually enable standard BitLocker and save the recovery key locally to a USB flash drive or a text file without linking a Microsoft account. If one does not use a Microsoft account, I strongly recommend keeping record of the key in multiple places because if it is lost, you're out of luck. Your only alternative would be a clean install.

TraderGary · Jul 7, 2026

Before you start messing with anything, be sure you have implemented a sound backup strategy. Data security must always come first.

hsehestedt · Jul 7, 2026

"Used space only" denotes the method used to encrypt the drive. In other words, when the drive was encrypted, the option to encrypt only used space was used rather than encrypting every byte of the drive whether there was data there or not. When the drive is encrypted, you can choose to encrypt only the data in the drive (the used space in the drive) or to encrypt the whole drive. When would you use each option?

Say you have a brand-new drive that never had any data on it. In that case, it's a no-brainer. Encrypting the unused areas of the disk buys you nothing, so used space only encryption is the choice to make.

However, if you have a drive that previously had data on it that was not encrypted and you want to make absolutely sure that even the deleted data is not recoverable, then you would encrypt the entire drive to ensure that previously deleted data is now encrypted and not recoverable. If you had data on the drive previously that does not need to be safeguarded, then you can simply encrypt the used space only.

Naturally, encrypting used space only will be a lot faster than encrypting the whole drive.

Note that other than making sure that all previously present data was encrypted, there is zero advantage to encrypting the whole drive.

hershey4 · Jul 8, 2026

Thanks for the info. There's a lot more to it than I thought.

So I take it that the performance hits (if any) of encryption are the same turning bitlocker on or off because the same encryption/decryption is happening regardless. Is that a fair conclusion?

What is the difference between Volume C and Volume W in Key Protectors and Automatic Unlock?

I don't think I will activate bitlocker. Reasons/Excuses: I have been using Macrium to do regular backups for years of my old computer (files and folders on W: to an external drive). WIll probably just do the same here. Photos are in the cloud. Its definitely not a mission critical system. I've never had a virus or malware in 20+ years. I access the internet carefully (adblockers, cynicism, awareness). I have a technical (legacy) background which seems to help at some instinctual level - although as time goes on and technology advances, that may prove to be useless.

hsehestedt · Jul 8, 2026

hershey4 said:
Thanks for the info. There's a lot more to it than I thought.

So I take it that the performance hits (if any) of encryption are the same turning bitlocker on or off because the same encryption/decryption is happening regardless. Is that a fair conclusion?

What is the difference between Volume C and Volume W in Key Protectors and Automatic Unlock?

I don't think I will activate bitlocker. Reasons/Excuses: I have been using Macrium to do regular backups for years of my old computer (files and folders on W: to an external drive). WIll probably just do the same here. Photos are in the cloud. Its definitely not a mission critical system. I've never had a virus or malware in 20+ years. I access the internet carefully (adblockers, cynicism, awareness). I have a technical (legacy) background which seems to help at some instinctual level - although as time goes on and technology advances, that may prove to be useless.

Automatic unlock is for drives other than the operating system drive. For example, let's say you have a second drive in your system. Or just another partition that you have Bitlocker protected. And your operating system drive is also Bitlocker protected. If your operating system drive is Bitlocker protected, then you can set other drives to automatically unlock. That way when you log on to the system you don't have to unlock those drives, they will just be automatically unlocked.. They rely upon the fact that the operating system drive is locked and that you must have signed on successfully in order to unlock the operating system drive. Once it is unlocked it takes that as authorization to go ahead and unlock the other drives. But again, you can only automatically unlock a drive if the operating system drive. Is already Bitlocker. Protected.

As for viruses and malware, BitLocker is not there to protect against those. In fact, it pretty much can do nothing against those. Its purpose for living is to ensure that if someone has physical access to your system (think stolen laptop as an example) that the person who got their hands on your equipment cannot get at the data.

For example, without BitLocker, I could simply plug your drive into another computer, take ownership of all the data, and have access to everything.

hershey4 · Jul 8, 2026

hsehestedt said:
As for viruses and malware, BitLocker is not there to protect against those.

didn't realize that. for some reason I was thinking ransomware protection

hsehestedt said:
For example, without BitLocker, I could simply plug your drive into another computer, take ownership of all the data, and have access to everything.

so for a desktop, just lock my doors at night. got it.

thinking back to a former encrypted work laptop that I never logged out of, if laptop was stolen, encryption would be useless???

Celery · Jul 8, 2026

hershey4 said:
Control panel status shows "waiting for activation" with an option to turn on bitlocker.

hershey4 said:
I don't think I will activate bitlocker.

If you don't want encryption, go to:

Settings > Privacy & security > Device encryption

Turn it Off.

Sign in with your Microsoft account to finish encrypting this device.webp

hershey4 · Jul 8, 2026

Celery said:
If you don't want encryption, go to:

Settings > Privacy & security > Device encryption

Turn it Off.

It's already off.

But on another topic, I am surprised at your screenshot showing that Msoft needed to encrypt. It was my understanding that I could store the key on a flashdrive or whatever when using a Local Account and WPro.

Marie SWE · Jul 8, 2026

hershey4 said:
So I take it that the performance hits (if any) of encryption are the same turning bitlocker on or off because the same encryption/decryption is happening regardless. Is that a fair conclusion?

I've never had a virus or malware in 20+ years.

hershey4 said:
didn't realize that. for some reason I was thinking ransomware protection

With today's SSD/NVMe disk speeds, a normal user dont notice the performance loss.
The only time you notice it is when you do stuff that is working a lot with heavy disk read/write.
With HDD 5400rpm then you do notice it on boot and when starting big programs.

That is both good.. and a bit odd you dont have heard about malware for 20+years

Nope Bitlocker dont protect from ransomware... actually there is malware that uses(abuses) windows bitlocker function to encrypt the user data for the ransom.

hershey4 · Jul 8, 2026

Marie SWE said:
...
The only time you notice it is when you do stuff that is working a lot with heavy disk read/write.

Like backups? it's already slow because I am going over the network. Restoring my data backups to the new PC over the network took days!!

Marie SWE · Jul 8, 2026

hershey4 said:
Like backups? it's already slow because I am going over the network. Restoring my data backups to the new PC over the network took days!!

no not really.. unless you backing up 10TB of data, then it can take a bit longer.. But everything under 1TB is not really noticeable.. you can measure it with a clock.. but you wont feel-feel it.
If you have around 10%ish performance loss. So a lot of data is noticeable.. and on old slow disks.. But not really on normal usage.

Edit
over the network.. Then you wont notice a thing, as the bottle neck is the Lan(probibly 1Gbit i guess), so not the disk-speed.. unless you have an old HDD 5400rpm and a 2.5Gbit Lan.. then the disk is the bottle neck.

Edit 2.
I never do full disk encryption, as you almost never need to encrypt that much data. I use VeraCrypt and containers for sensitive files. I try to keep them at 4.3GB so i easy can copy them to DVD-r disks for archiving and still have the data encrypted.
There is no point of encrypt my TV-shows, movies and music.. also i dont encrypt my system disks as i never keep sensitive data on them.. I dont think anyone would have interest of my browsers bookmarks or if i have saved a few memes for forum usage. *lol*

barreleye · Jul 8, 2026

Marie SWE said:
I never do full disk encryption, as you almost never need to encrypt that much data. I use VeraCrypt and containers for sensitive files. I try to keep them at 4.3GB so i easy can copy them to DVD-r disks for archiving and still have the data encrypted.
There is no point of encrypt my TV-shows, movies and music.. also i dont encrypt my system disks as i never keep sensitive data on them.. I dont think anyone would have interest of my browsers bookmarks or if i have saved a few memes for forum usage. *lol*

Full disk encryption (FDE) is the only way to go, especially for the system drive. When you pick and choose what to encrypt, you miss all kinds of potential data leakage, from data stored behind the scenes in hidden folders like AppData (e.g.Outlook .pst files) and ProgramData, to the contents of TEMP folders (e.g. WinRAR won't delete files it extracted to it for viewing unless configured to "Wipe temporary files"), to pagefile/hibernation file contents, to your own carelessness.

hershey4 · Jul 8, 2026

Good to put all the pieces in perspective. I suspected the LAN was probably a big part. I'm supposed to be 800mbs but I think comcast downgrades me cuz I have own equipment. By the time it reaches my PC, speed is 50-60. Maybe more late at night. My neighbor on shared wall has 1gbs. At my PC, its 200-250mbs in peak times. I shoulda used her network when I did those restores. (we're friends, she knows).
And that external drive (4TB) is probably over 5 years old now (boy time flies), so that's likely a bottleneck too. And looking at it now, I see it's using an A->C cable. that's probably no good either.

Marie SWE · Jul 8, 2026

barreleye said:
Full disk encryption (FDE) is the only way to go, especially for the system drive. When you pick and choose what to encrypt, you miss all kinds of potential data leakage, from data stored behind the scenes in hidden folders like AppData (e.g.Outlook .pst files) and ProgramData, to the contents of TEMP folders (e.g. WinRAR won't delete files it extracted to it for viewing unless configured to "Wipe temporary files"), to pagefile/hibernation file contents, to your own carelessness.

Everything depends on your own use case..

For me, i dont have browser disk cache, so i dont have to worry about that. cookies is erased on shutdown. I dont use a local email client.. only web-interface.. and my emails is not sensitive as its like sending a postcard over the internet.. email is sent in clear text unless you encrypt the email and the receiver has the decryption key.
Then i also have several computers so i do device isolation, so i never use this computer for banking or other sensitive things on that level.
and that computer is the same.. i never have disk cache enabled, and i never stay logged in on important sites if i leave the computer.. so RAM and swap isn't a risk... for me zip/rar etc.. is never important data.. that is usually if i download drivers or a program for install or something like that.

hsehestedt · Jul 8, 2026

hershey4 said:
thinking back to a former encrypted work laptop that I never logged out of, if laptop was stolen, encryption would be useless???

If you lock your desktop, then you are fine if it has BitLocker. Of course, if you don't logoff AND leave it sitting on the desktop without locking it, sure, anyone could simply walk up to that machine and use it then.

Understanding bitlocker conversion status

Active member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

I almost never bite.......

My Computers My Computers

At a glance

At a glance

aka Mama Glass

My Computers My Computers

At a glance

At a glance

Stock Market Wizard

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computers My Computers

At a glance

At a glance

I almost never bite.......

My Computers My Computers

At a glance

At a glance

Active member

My Computers My Computers

At a glance

At a glance

I almost never bite.......

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computers My Computers

At a glance

At a glance

I almost never bite.......

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computers

My Computer

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computer

My Computers

My Computers

My Computers