Clone a BitLocker-encrypted disk

Many Windows 11 PCs are encrypted without the customer knowing it: device encryption turns on at the first sign-in with a Microsoft account. Before cloning, you need to know it, have the key, and decide whether to keep the encryption.

Is the disk encrypted?

In Settings: Privacy & security, Device encryption (or “Manage BitLocker” in Control Panel).
In File Explorer: a padlock on drive C:.
In a Command Prompt run as administrator: manage-bde -status C:. The command shows the percentage encrypted and the protection status.

First: the recovery key

It is a sequence of 48 digits. The customer can find it at account.microsoft.com/devices/recoverykey, with their Microsoft account, or get it from their IT department for a company PC. On the running PC, manage-bde -protectors -get C: shows the disk’s protectors, including this recovery password.

Have it before you start: if an encrypted disk asks for it and nobody has it, its data is lost.

Three ways to do it

Copy unencrypted: Windows presents its files decrypted, you copy them, and the new disk is not encrypted. You turn encryption back on afterwards, with a new key.
Keep encryption: the encrypted partition is copied as it is, sector by sector. The new disk opens with the same key.
Decrypt before cloning, then encrypt again: this works with any tool, but decryption and encryption each take hours.

In every case, wait until any encryption or decryption in progress has finished: a half-encrypted disk does not clone cleanly.

With MBI Clone

The Windows of the running PC is copied unencrypted, without being decrypted first: MBI Clone reads the files that Windows presents. Only the existing files are copied, never the free space, where old deleted files would end up unencrypted on the new disk. Before starting, a box makes you confirm: “I understand: the new disk will not be encrypted”. The old disk stays encrypted.

The disk of another PC, connected to the workshop computer, is unlocked first. You then choose:

Keep encryption (same key): MBI Clone asks for the customer’s key and checks that it opens their disk, read-only, before writing anything. The encrypted partition is copied as it is, and the extra space on the new disk stays free just after C:, so that C: can be extended afterwards. The key is not written anywhere.
Copy unencrypted: the files are copied one by one, and the new disk is not encrypted.

At first boot

Encryption kept, in the customer’s PC: Windows may ask for the key once, because its boot was rebuilt and the PC’s security chip notices it. Type it in, and Windows starts.
Encryption kept, in another PC: the key is asked for at every startup until protection is set up again on that PC’s chip. In Manage BitLocker, “Suspend protection”, then “Resume protection”. With commands: manage-bde -protectors -disable C:, then manage-bde -protectors -enable C:.
Unencrypted copy: to turn encryption back on, Settings, Privacy & security, Device encryption (or Manage BitLocker). A new key is created: the previous one only opens the old disk. Windows may also restart its automatic encryption by itself at first boot, and ask for a Microsoft account to complete it.

Pitfalls

The customer did not know their PC was encrypted: ask them whether they want it to stay that way. On a family PC, it is often the automatic encryption.
The new key: make sure the customer keeps it. Device encryption stores it in their Microsoft account; with Manage BitLocker, Windows asks where to keep it.
The old disk: keep it as it is until the new one has booted successfully for the first time.

Common questions

Do I need to decrypt the disk before cloning?

Not necessarily. A tool that reads the running Windows copies the files unencrypted, and a tool that copies the partition as it is keeps the encryption.

Why does Windows ask for the key after the disk is changed?

The PC’s security chip checks the boot: if it has changed, the chip asks for the key, once. It is a protection, not a fault.

What if the customer does not have their key?

On the running PC, manage-bde -protectors -get C: shows it. If the PC no longer boots and the key cannot be found, the data on the encrypted disk is lost: that is the whole point of encryption.