Is there any difference between a BitLocker recovery key file and numerical password that would negatively impact my ability to unlock the drive in a disaster scenario?
I frequently encrypt USB hard drives that are used for backups with BitLocker. I save the .BEK
file on the server being backed up and use that to unlock the drives. However, I also save offsite the Numerical Password as well as a copy of the .BEK
file.
If it's not necessary to save both of these offsite, it would be simpler not to. But before I stop doing so I need to know if there are any differences or gotchas between these two unlock methods I need to take into consideration.
Some Details
- I'm doing this on Server 2008, Server 2008 R2, Server 2012, and Server 2012 R2 machines
- I never store the keys in a TPM
- I use "regular" BitLocker (not To-Go)
On Server 2008/R2 I enable BitLocker with:
manage-bde -on X: -rk "C:\BitLocker Keys" -rp
on Server 2012/R2 I enable BitLocker with:
manage-bde -on "\\?\Volume{GUID}\" -rk "C:\BitLocker Keys" -rp -used