Kad su velike telekomunikacije, komunalne tvrtke, pa čak i vlada pogođene kršenjem podataka^{(data breaches)} , kakve šanse imate? Iznenađujuće dobra šansa ako poduzmete nekoliko ključnih mjera. Jedna od tih mjera je šifriranje vašeg tvrdog diska ili SSD-^{(encrypting your hard drive or SSD)} a . 

Windows 10 ima način šifriranja vašeg ugrađenog diska pomoću Microsoftove tehnologije BitLocker . Jednostavan je za implementaciju, jednostavan za korištenje i ne zahtijeva nikakve posebne vještine ili hardver. Međutim, morate imati Windows Pro , Enterprise ili Education verzije sustava Windows 10 . Ako imate Windows 10 Home , VeraCrypt enkripcija^{(VeraCrypt encryption)} je izvrsna opcija. Možda vam je čak draži od BitLockera^(BitLocker) . 

Što je BitLocker?^{(What Is BitLocker?)}

Šifriranje je proces promjene informacija u nešto besmisleno osim ako nemate ključ. BitLocker šifrira informacije na tvrdim diskovima tako da se mogu pročitati samo nakon što se unese ključ. Ključem se može upravljati pomoću čipa Trusted Platform Module (TPM) u računalu, USB pogona koji pohranjuje ključ ili čak samo lozinke. Ako isprobate BitLocker i ne volite ga, lako je isključiti BitLocker^{(turn BitLocker off)} .

Zašto bih trebao šifrirati svoj Windows tvrdi disk?^{(Why Should I Encrypt My Windows Hard Drive?)}

Pretpostavimo da koristite najbolje primjere iz prakse^{(password best practices)} . Vaša lozinka je složena, teško ju je pogoditi i ne zapisujete je niti je dijelite ni s kim. Ako netko želi dobiti podatke s vašeg pogona, a nema vašu lozinku za Windows , može ukloniti tvrdi disk, priključiti ga na drugo računalo i koristiti Linux live CD za oporavak datoteka^{(Linux live CD to recover files)} . 

Ako koristite BitLocker , oni to ne mogu učiniti. BitLocker mora odnekud moći dobiti ključ. U idealnom slučaju^(Ideally) , to bi bio Trusted Platform Module ( TPM ). To također može biti šifra ili USB pogon namijenjen kao BitLocker ključ.

"Ali nitko mi neće ukrasti pogon", odgovarate. Jeste li ikada izbacili računalo? Uz to su išli i tvoji tvrdi diskovi, zar ne? Osim ako na siguran način odložite tvrdi disk^{(safely dispose of a hard drive)} , netko može dobiti podatke. To se događa svaki dan, i lako je. Imamo čak i članak o tome kako pristupiti datotekama na starim pogonima^{(how to access files on old drives)} .

Ako ste upotrijebili BitLocker i izvadili disk iz računala, a zatim odložili računalo i pogon odvojeno, samo ste eksponencijalno otežali posao slučajnog kradljivca podataka. Bilo bi potrebno da stručnjak za oporavak podataka ima čak i daleke šanse za dobivanje vaših podataka. Jeste li već uvjereni^(Convinced) ?

Kako provjeriti ima li računalo TPM^{(How to Check if a Computer Has a TPM)}

Idealna situacija s BitLockerom^(BitLocker) je na uređaju s TPM -om . Ima li vaš uređaj TPM ? Lako je to provjeriti.

1. Odaberite izbornik Start i upišite sustav^(system) . Prvi rezultat bi trebao biti System Information . Odaberite to.

1. Kada se otvori prozor s informacijama o sustavu , unesite ^{(System Information)}pouzdano^{(trusted )} u okvir Find what: na dnu, a zatim odaberite Find ili pritisnite Enter .

1. Ako uređaj ima TPM , to će se prikazati u rezultatima. U ovom primjeru TPM postoji i to je verzija 2.0 TPM . Verzija bi mogla biti važna u budućnosti, osobito nakon što Windows 11 bude javno dostupan.

Kako omogućiti BitLocker na uređaju s TPM-om^{(How to Enable BitLocker On a Device With a TPM)}

Vaš uređaj ima TPM pa je ovaj sljedeći dio jednostavan i lak.

1. Otvorite File Explorer i idite do pogona koji želite šifrirati BitLockerom^(BitLocker) .

Desnom tipkom miša kliknite^{(Right-click)} pogon i odaberite Uključi BitLocker^{(Turn on BitLocker)} .

Možda postoji poruka o pokretanju BitLockera^{(Starting BitLocker )} s trakom napretka. Neka završi.

1. Od vas će se tražiti da odaberete kako želite otključati ovaj pogon^{(Choose how you want to unlock this drive)} . Postoje 2 izbora; Koristite lozinku za otključavanje pogona^{(Use a password to unlock the drive)} ili Upotrijebite moju pametnu karticu za otključavanje pogona^{(Use my smart card to unlock the drive)} . Ako se uređaj koristi u poslu, možda imate pametnu karticu i želite je koristiti. Ako ne, odaberite korištenje lozinke. Napravite jaku, sigurnu lozinku^{(Create a strong, secure password)} .

Lozinka će biti potrebna samo ako je pogon uklonjen s ovog uređaja i instaliran na drugi uređaj. U suprotnom, TPM će upravljati unosom lozinke, čime će šifrirani disk raditi besprijekorno sa svim ostalim.

Sada se pita Kako želite sigurnosno kopirati svoj ključ za oporavak?^{(How do you want to back up your recovery key?)} 

Postoje 4 opcije:

• Spremi na svoj Microsoftov račun^{(Save to your Microsoft account)} : ako koristite Microsoftov^(Microsoft) račun za prijavu na uređaj, ovo je najjednostavniji način. To je ono što se koristi u ovom primjeru.
• Spremi na USB flash pogon^{(Save to a USB flash drive)} : Ako je odabrana ova metoda, koristite samo USB flash pogon u tu svrhu. Ne pokušavajte pohraniti druge stvari na taj flash pogon.
• Spremi u datoteku^{(Save to a file)} : ako odaberete ovu metodu, nemojte spremati datoteku na pogon koji se šifrira. Spremite ga na drugi disk ili pohranu u oblaku.
• Ispis ključa za oporavak^{(Print the recovery key)} : odabir ove metode znači da ispisani ključ treba sigurno pohranjivanje, sigurno od požara, krađe i poplave. Kada je ključ potreban, morat ćete ga ručno upisati.

Ovisno o odabranoj metodi, mogu postojati neki dodatni koraci, ali sve metode će na kraju dovesti do sljedećeg zaslona.

Ovaj korak traži da odaberete koliko vašeg diska želite šifrirati^{(Choose how much of your drive to encrypt)} . To može biti zbunjujuće. Ako na pogonu ništa nije šifrirano, odaberite Šifriraj samo iskorišteni prostor na disku^{(Encrypt used disk space only)} . Vrlo je brz. 

Sve što se doda na disk nakon ovoga bit će automatski šifrirano. Ako pogon već ima datoteke i mape na sebi, odaberite Šifriraj cijeli pogon^{(Encrypt entire drive )} kako biste bili sigurni da su sve odmah šifrirane. Zatim odaberite Sljedeće^(Next) .

Sljedeći zaslon se možda neće prikazati ovisno o verziji sustava Windows koju koristite. Važno je odvojiti vrijeme da ga pročitate i shvatite. 

Ukratko, ako netko ikada izvadi disk iz ovog uređaja i stavi ga u bilo koju verziju sustava Windows prije Windows 10 verzije 1511^{(Version 1511)} , pogon neće raditi. Većina ljudi to nikada neće učiniti, pa će većina odabrati Novi način šifriranja^{(New encryption mode)} , a zatim odabrati Sljedeće^(Next) .

Šifriranje je ozbiljan posao i stvari mogu poći po zlu. Zato će proces posljednji put pitati: Jeste li spremni za šifriranje ovog pogona? ^{(Are you ready to encrypt this drive? )}Ako je tako, odaberite Pokreni šifriranje.^{(Start encrypting.)}

Nakon što BitLocker završi šifriranje pogona, vratite se na File Explorer . Primijetite^(Notice) da ikona pogona sada ima otključan lokot. To znači da je pogon šifriran, ali spreman za primanje datoteka. Ako je lokot zaključan, za pristup mu je potrebno unijeti lozinku.

Kako omogućiti BitLocker na uređaju bez TPM-a^{(How to Enable BitLocker On a Device Without TPM)}

Za sada postoji način korištenja BitLockera^(BitLocker) za šifriranje pogona čak i ako uređaj nema TPM . Očekujte da se to promijeni u sustavu Windows 11^{(Windows 11)} jer Windows 11 zahtijeva TPM 2.0^{(Windows 11 requires TPM 2.0)} za nadogradnju sa Windows 10 na Windows 11 . Ova metoda zahtijeva posjedovanje administratorskih prava.

1. Pritisnite kombinaciju tipki Win^{(Win Key )} + R da biste otvorili uslužni program Run. U polje Otvori^{(Open )} unesite gpedit.msc , zatim odaberite U redu^{(OK )} ili pritisnite Enter . Ovo će otvoriti uređivač lokalnih grupnih pravila^{(Local Group Policy Editor)(Local Group Policy Editor)} .

1. Nakon što se otvori Local Group Policy Editor , idite na Konfiguracija računala^{(Computer Configuration )} > Administrativni predlošci^{(Administrative Templates )} > Windows komponente^{(Windows Components )} > BitLocker šifriranje pogona^{(BitLocker Drive Encryption )} > Pogoni operativnog sustava^{(Operating System Drives)} . Dvaput kliknite na postavku Zahtijevaj dodatnu provjeru autentičnosti pri pokretanju^{(Require additional authentication at startup)} .

1. Odaberite Omogućeno^{(Enabled )} , a zatim U redu^{( OK)} za promjenu postavke. Zabilježite potvrdni okvir u kojem piše: „Dopusti BitLocker bez kompatibilnog TPM-a. ^(TPM.)” Ovo omogućuje korištenje lozinke ili sigurnosnog ključa za pristup BitLocker šifriranom pogonu. Ponovno pokrenite^(Restart) Windows da biste aktivirali postavku.

1. Slijedite isti postupak kao u gornjem odjeljku da biste pokrenuli BitLocker i šifrirali pogon. UPOZORENJE:^{(WARNING: )} Ako je šifriranje Windows pogona završeno, svaki put kada se Windows pokrene, mora se unijeti lozinka da bi se Windows učitao. Zabilježite lozinku na sigurnom mjestu izvan uređaja.
2. Sljedeći put kada se Windows pokrene, BitLocker će zahtijevati unos lozinke za otključavanje pogona. Učinite to i pritisnite Enter za nastavak.

Jeste li sada sigurni?^{(Are You Secure Now?)}

BitLocker enkripcija samo je jedan dio zaštite vaših podataka. Što još činite kako biste osigurali zaštitu vaše privatnosti i identiteta? Obavijestite nas! Svakako^(Make) provjerite sve naše članke o sigurnosti podataka i privatnosti .^{(data security and privacy)}

How to Encrypt Windows 10 Hard Drive with Bitlocker

When large telecoms, utilities, and evеn thе government are getting hit with data breaches, what chance do you stand? A surprisingly good chance if you take a few key measures. One of those measures is encrypting your hard drive or SSD. 

Windows 10 has a way to encrypt your built-in drive with Microsoft’s BitLocker technology. It’s easy to implement, easy to use, and doesn’t require any special skills or hardware. However, you do need to have Windows Pro, Enterprise, or Education versions of Windows 10. If you have Windows 10 Home, VeraCrypt encryption is an excellent option. You may even prefer it to BitLocker. 

What Is BitLocker?

Encryption is the process of changing information into something meaningless unless you have the key. BitLocker encrypts information on hard drives so that it can only be read once the key is entered. The key may be managed by a Trusted Platform Module (TPM) chip in the computer, a USB drive that stores the key, or even just a password. If you try BitLocker and don’t like it, it’s easy to turn BitLocker off.

Why Should I Encrypt My Windows Hard Drive?

Let’s assume you use password best practices. Your password is complex, hard to guess, and you don’t write it down or share it with anyone. If someone wants to get data from your drive and they don’t have your Windows password, they could remove the hard drive, plug it into another computer, and use a Linux live CD to recover files. 

If you’re using BitLocker, they can’t do that. BitLocker has to be able to get the key from somewhere. Ideally, that would be the Trusted Platform Module (TPM). It could also be a passphrase or a USB drive dedicated as a BitLocker key.

“But no one is going to steal my drive,” you respond. Have you ever thrown a computer out? Your hard drives went with it too, didn’t they? Unless you safely dispose of a hard drive, someone can get the data. This happens every day, and it’s easy. We even have an article on how to access files on old drives.

If you used BitLocker and took the drive out of the computer then disposed of the computer and drive separately, you just made the casual data thief’s job exponentially harder. It would require a data recovery specialist to even have a remote chance of getting your data. Convinced yet?

How to Check if a Computer Has a TPM

The ideal BitLocker situation is on a device with a TPM. Does your device have a TPM? It’s easy to check.

1. Select the Start menu and type system. The first result should be System Information. Select that.

1. When the System Information window opens, enter trusted in the Find what: box at the bottom, then select Find or press Enter.

1. If the device has a TPM, it will show in the results. In this example, TPM does exist and it’s a version 2.0 TPM. Version may be important in the future, especially once Windows 11 is publicly available.

How to Enable BitLocker On a Device With a TPM

Your device has a TPM, so this next part is simple and easy.

1. Open File Explorer and navigate to the drive to be encrypted with BitLocker.

Right-click on the drive and select Turn on BitLocker.

There may be a Starting BitLocker message with a progress bar. Let it finish.

1. It will prompt you to Choose how you want to unlock this drive. There are 2 choices; Use a password to unlock the drive, or Use my smart card to unlock the drive. If the device is being used in a business, you may have a smart card and want to use that. If not, then choose to use a password. Create a strong, secure password.

The password will only be needed if the drive is removed from this device and installed on another device. Otherwise, the TPM will handle the entering of the password, making the encrypted drive work seamlessly with everything else.

Now it asks How do you want to back up your recovery key? 

There are 4 options:

• Save to your Microsoft account: If you use a Microsoft account to log in to the device, this is the easiest method. It’s what’s being used in this example.
• Save to a USB flash drive: If this method is chosen, only use the USB flash drive for this purpose. Do not try to store other things on that flash drive.
• Save to a file: If choosing this method, don’t save the file to the drive being encrypted. Save it to another drive or cloud storage.
• Print the recovery key: Choosing this method means the printed key needs secure storage, safe from fire, theft, and flood. When the key is needed, it’ll need to be manually typed in.

Depending on the method selected, there may be some additional steps, but all methods will eventually lead to the next screen.

This step asks to Choose how much of your drive to encrypt. That may be confusing. If there’s nothing on the drive being encrypted, select Encrypt used disk space only. It’s very fast. 

Anything added to the drive after this will be automatically encrypted. If the drive already has files and folders on it, choose Encrypt entire drive to ensure they’re all encrypted immediately. Then select Next.

The next screen might not display depending on the version of Windows you’re using. It’s important to take the time to read and understand it. 

To sum up, if anyone ever takes the drive out of this device and puts it into any version of Windows prior to Windows 10 Version 1511, the drive won’t work. Most people won’t ever do that, so most will choose New encryption mode, then select Next.

Encryption is serious business and things can go wrong. That’s why the process will ask one last time, Are you ready to encrypt this drive? If so, select Start encrypting.

Once BitLocker is done encrypting the drive, go back to File Explorer. Notice that the drive icon now has an unlocked padlock. That means the drive is encrypted but ready to receive files. If the padlock was locked, you would need to enter the password to access it.

How to Enable BitLocker On a Device Without TPM

For now, there is a way to use BitLocker to encrypt a drive even if the device doesn’t have TPM. Expect that to change in Windows 11 as Windows 11 requires TPM 2.0 to upgrade from Windows 10 to Windows 11. This method requires having administrator rights.

1. Press the key combo Win Key + R to open the Run utility. In the Open field enter gpedit.msc, then select OK or press Enter. This will open the Local Group Policy Editor.

1. After the Local Group Policy Editor opens, navigate to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Double-click on the setting Require additional authentication at startup.

1. Select Enabled and then OK to change the setting. Note the checkbox where it reads, “Allow BitLocker without a compatible TPM.” This allows for the use of a password or security key to be used to access the BitLocker encrypted drive. Restart Windows to activate the setting.

1. Follow the same procedure as in the section above to start BitLocker and encrypt a drive. WARNING: If encrypting the Windows drive is done, every time Windows starts, the password must be entered for Windows to load. Record the password in a secure place off of the device.
2. The next time Windows is started, BitLocker will require the password to be entered to unlock the drive. Do that and press Enter to continue.

Are You Secure Now?

BitLocker encryption is only one part of securing your data. What else are you doing to ensure your privacy and identity are protected? Let us know! Make sure to check out all of our data security and privacy articles.

Related posts

• C ili D slovo pogona nedostaje u sustavu Windows 10

• Popravite nedodijeljeni tvrdi disk bez gubitka podataka u sustavu Windows 10

• IsMyHdOK je besplatni softver za provjeru ispravnosti tvrdog diska za Windows 10

• Kako klonirati tvrdi disk u sustavu Windows 10

• Kako formatirati tvrdi disk na Windows 10

• Kako promijeniti ikonu pogona u sustavu Windows 10

• Sinkronizirajte više računa Google diska u sustavu Windows 10

• Dodajte ili uklonite karticu ReadyBoost u svojstvima pogona u sustavu Windows 10

• QuickEncrypt vam omogućuje šifriranje i dešifriranje datoteka i mapa u sustavu Windows 10

• Kako promijeniti veličinu klastera tvrdog diska u sustavu Windows 10

• Kako izbaciti vanjski tvrdi disk na Windows 10

• Kako prikvačiti mapu ili disk na traku zadataka u sustavu Windows 10

• Preimenujte fizički disk u spremištu za pohranu prostora za pohranu u sustavu Windows 10

• Kako migrirati Windows 10 na novi tvrdi disk

• Ne možete izbaciti vanjski tvrdi disk u sustavu Windows? 7 mogućih popravaka

• Kako dodati ili ukloniti karticu Quota u svojstvima pogona u sustavu Windows 10

• Nemojte automatski šifrirati datoteke premještene u šifrirane mape u sustavu Windows 10

• Šifrirajte datoteke i mape pomoću sustava šifriranja datoteka (EFS) u sustavu Windows 10

• 10 načina da oslobodite prostor na tvrdom disku u sustavu Windows 10

• 2 načina mapiranja mrežnog pogona u sustavu Windows 10