'New Windows update complicates digital forensics'
In Windows 11 version 24H2, disk encryption by BitLocker is enabled by default. It also affects devices in the consumer segment. This change will have long-term implications for forensics, Elcomsoft says. The Russian software company headquartered in Moscow provides forensic tools for investigative agencies, among other things.
Information Security Netherlands May 21, 2025
"The Windows 11 24H2 update introduces a change in Microsoft's approach to disk encryption, a change that will have major implications for digital forensics," writes Elcomsoft's Oleg Afonin on his blog. "With this release, BitLocker encryption is automatically enabled on most modern hardware when Windows is installed with a Microsoft Account."
Recovery key
A workaround for not using a Microsoft Account during installation has been removed by Microsoft. This has made it more difficult to bypass the default disk encryption. Recovery keys are automatically uploaded to the Microsoft user account for personal devices. These can be requested by legal means for investigative agencies but that will lead to more delays and procedural complications, Afonin said.
Click
here for Oleg Afonin's blog post.
