Windows Defender Offline Scan/ Bitlocker Question


D

duecks

Member
Local time
12:47 PM
Posts
18
OS
WIndows 11 Pro
Hello,

I used the BitLocker manager and saved my bitlocker keys to a usb drive and printed them out.

Attempted to do a windows defender offline scan. It asked to plug in the usb drive but could not find the bitlocker code. I get a message saying " there is not a valid recovery key on this drive"

If I type in the bitlocker key manually, the scan runs with no problem.

I tried different usb drives with the same result, tried formatting with fat32 and ntfs, still did not work with the usb method.

Is it possible that a usb driver is not loading?

Is it possible that the usb drive should be formatted as a bootable drive?
 

My Computer My Computer

At a glance

WIndows 11 Pro
OS
WIndows 11 Pro
Computer type
PC/Desktop
Manufacturer/Model
HP
I just tried running an offline scan on my computer with the same result. I think it has something to do with the way the Defender offline scan works. I also have my Bitlocker keys printed out and saved to a USB thumb drive. For some reason it won't read the flash drive, requiring the key to be typed in.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro Version 24H2 OS build 26100.672513th Gen Intel Core i7-13700 2.10 GHz32 GBIntel UHD Graphics 770 / NVIDIA GeForce RTX 3060
    OS
    Windows 11 Pro Version 24H2 OS build 26100.6725
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8960
    CPU
    13th Gen Intel Core i7-13700 2.10 GHz
    Memory
    32 GB
    Graphics Card(s)
    Intel UHD Graphics 770 / NVIDIA GeForce RTX 3060
    Monitor(s) Displays
    Dell S2421H / Dell SE2222H
    Screen Resolution
    1920x1080
    Hard Drives
    C: Crucial CT1000P5PSSD8
    D: Seagate ST2000DM008
    E: Seagate ST4000DX005
    Keyboard
    Logitech K650
    Mouse
    Logitech M650L
    Internet Speed
    200 Mbps
    Browser
    Firefox/Edge
    Antivirus
    Windows Security

  • At a glance

    Windows 11 Pro 23H2 Build 22631.454110th Gen Intel(R) Core(TM) i5-10400 CPU @ 2.9...24 GB
    Operating System
    Windows 11 Pro 23H2 Build 22631.4541
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Inspiron 3880
    CPU
    10th Gen Intel(R) Core(TM) i5-10400 CPU @ 2.90GHz
    Memory
    24 GB
    Monitor(s) Displays
    Dell S2421H
    Screen Resolution
    1920x1080
    Hard Drives
    C:\ - Crucial 1 TB NVME SSD
When you saved the BitLocker key, was in a human-readable recovery password or a computer-only recovery key? Windows Defender offline runs from the Recovery environment, and it expects you to provide a drive with the non-text file version.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
When you saved the BitLocker key, was in a human-readable recovery password or a computer-only recovery key? Windows Defender offline runs from the Recovery environment, and it expects you to provide a drive with the non-text file version.
Click to expand...
Its a human readable key.
The usb key is text. The same as if I print it out.

If its supposed to be a non text file version, then how would you obtain that?
 

My Computer My Computer

At a glance

WIndows 11 Pro
OS
WIndows 11 Pro
Computer type
PC/Desktop
Manufacturer/Model
HP
garlin said:
When asked, “Save to a USB flash drive” instead of “Save to a file”.

Back Up Your BitLocker Recovery Key | Microsoft Support

Learn about BitLocker recovery keys and how to back them up.
support.microsoft.com support.microsoft.com
Click to expand...
I did that.

Saved it to the USB, saved it to my Microsoft account and printed it. All 3 locations have the same key.

The USB saved file is text, readable with notepad, the same as the printed copy and Microsoft account.

Is the USB file supposed to be a different format?
 

My Computer My Computer

At a glance

WIndows 11 Pro
OS
WIndows 11 Pro
Computer type
PC/Desktop
Manufacturer/Model
HP
Does the filename end with .BEK or .TXT?
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
Does the filename end with .BEK or .TXT?
Click to expand...
They all end in .txt but, I have not checked for hidden files. I'll try that in a few days.
Thanks
 

My Computer My Computer

At a glance

WIndows 11 Pro
OS
WIndows 11 Pro
Computer type
PC/Desktop
Manufacturer/Model
HP
You'll have to unhide "protected operating system files" in Explorer to see any .BEK files.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
You'll have to unhide "protected operating system files" in Explorer to see any .BEK files.
Click to expand...

OK, I tried that, now I can see .bek, .txt files, and a volume information folder, but the offline scan still did not work.

I used this website as a guide:

Wisely Managing BitLocker via Command Line

This post article deciphers how to manage BitLocker with command line, which is all about a series of Manage-bde commands. Remember that Manage-bde is the key command-line tool.
www.m3datarecovery.com www.m3datarecovery.com
and used this command, step 5, to manually copy the necessary files to the usb drive:

manage-bde -protectors -add C: -recoverykey F:\

(changed F:\ to my usb drive)

Now it works, the offline scan completes!

Went a little further and formatted the same usb drive and used the bitlocker manager and retried what I did the first time, received the same original error message when performing the offline scan.

Formatted and used the command line method again that worked.

Not sure why the first method did not work for me and the command line did.

Thanks for the responses.
 

My Computer My Computer

At a glance

WIndows 11 Pro
OS
WIndows 11 Pro
Computer type
PC/Desktop
Manufacturer/Model
HP
You must log in or register to reply here.

Similar threads

  • Article Article
BitUnlocker: Leveraging Windows Recovery to Extract BitLocker Secrets
Replies
0
Views
928
Brink
Brink
  • Article Article
Privacy and Security Run Microsoft Defender Offline Scan in Windows 11
Replies
5
Views
41K
Brink
Brink

Latest Support Threads

Latest Tutorials

Back
Top Bottom