I have a 4TB drive that has been bitlocker encrypted (via password) since day one and want to wipe it before I sell it used. The process looks like it's going to take 100+ hours via nwipe but I was wondering if there was any public info on what sectors the bitlocker encryption info is stored so I could just wipe those. As I understand it the password is merely the encryption key for the actual encryption key and the encryption key is stored somewhere on the drive. Anyone have any references to if this is a correct assumption and/or what sectors hold that info so I can just wipe those and sell the drive? Thanks in advance for any help!
There are actually multiple keys.
The key used to do the encryption, the Full Volume Encryption Key (FVEK), is stored in the BitLocker metadata on the protected volume. Each sector is encrypted independently.
The FVEK is encrypted using another key, the Volume Master Key (VMK). Three copies of the VMK are also stored in the metadata.
Each copy of the VMK is encrypted using one or more externally-supplied key/password protectors, such as TPM, PIN, User Password, Recovery Password, Recovery Key, Startup Key, or smart card.
The FVEK or VMK cannot be used if the externally-supplied key protectors are not known. So this exercise isn't going to do much for you if protection was not suspended (clear key in use) or the password was weak. It's also likely that the drive is now trashed to the point where it may not be possible to identify the FVEK or VMK in the volume metadata.
You can download a tool to validate the metadata:
libbde - BitLocker Drive Encryption (BDE) format specification:
See section 4, Volume Header. This has the starting location of the FVE metadata blocks. Section 5 has the format of the FVE metadata blocks. Section 5.3 has the FVE metadata types.