Most Edinburgh laptops we see in the workshop have one thing in common: an unencrypted hard drive packed with personal files. Bank statements, work documents, photos, browser-saved passwords — all of it readable by anyone who removes the drive and plugs it into another machine. If your laptop ever gets nicked off a café table on George Street or left on the train back to Leith, that's a serious problem.
The good news? Windows 11 has a built-in fix called BitLocker. Once it's switched on, the entire drive is scrambled with strong AES encryption, and the data is unreadable without your password or PIN. Here's how to turn it on, what to watch out for, and how to avoid locking yourself out.
What Is BitLocker, in Plain English?
BitLocker is Microsoft's full-disk encryption tool. When it's active, every file on your drive is mathematically scrambled. The only way to unscramble it is with the correct key, which is normally tied to your Windows login and a hardware chip on your motherboard called the TPM (Trusted Platform Module). Take the drive out, plug it into another PC, and all anyone sees is gibberish.
This protects you against a very specific scenario: someone with physical access to your laptop trying to read your files offline. It does not protect against viruses, phishing, or someone who already knows your Windows password — for those, our signs your PC has a virus and phishing scams guides are worth a read.
Does My PC Support BitLocker?
Two things need to be true:
- Windows 11 Pro, Enterprise or Education for the full BitLocker experience. Windows 11 Home gets a slimmed-down version called Device Encryption, which is on by default on most modern laptops bought from 2024 onwards.
- TPM 2.0 on the motherboard, plus Secure Boot enabled in UEFI. If you've already upgraded to Windows 11 you almost certainly meet both requirements.
To check quickly, press Win + R, type tpm.msc and press Enter. If the window says “The TPM is ready for use” you're good. If you see “Compatible TPM cannot be found,” the chip is probably disabled in BIOS — we cover this in our how to check your PC specs walkthrough.
Step-by-Step: Turning On BitLocker
- Back up your important files first. Encryption is a heavy operation and, while failures are rare, you don't want to be without a copy. See our PC backup guide if you need a sensible setup.
- Open the Start menu, type Manage BitLocker and click the result.
- Find your operating system drive (usually C:) and click Turn on BitLocker.
- Choose how you want to unlock the drive at boot. A PIN gives you stronger protection than relying on the TPM alone — we recommend it for any laptop that leaves the house.
- Pick how to back up your recovery key (more on this in a moment). You can save it to your Microsoft account, a USB stick, a file, or print it. Pick at least two of those options.
- When asked, choose Encrypt entire drive rather than “used disk space only” on any laptop you've owned for a while — deleted files can still leak otherwise.
- Leave New encryption mode (XTS-AES) selected. This is fine for any internal drive on a modern PC.
- Run the BitLocker system check, then restart. Windows will encrypt the drive in the background — you can keep working while it runs.
The Recovery Key: Don't Skip This
The single most common reason we see Edinburgh laptops in the shop with a BitLocker problem is a forgotten recovery key. If Windows ever decides something has changed at boot — a BIOS update, a swapped motherboard, a dodgy update — it will demand a 48-digit recovery key before it lets you in. No key, no data. We can't crack it for you and Microsoft can't either.
Save your recovery key in at least two safe places: your Microsoft account at account.microsoft.com/devices/recoverykey, and either a printed copy in a drawer or a password manager. Don't save it as a file on the same drive you've just encrypted — if you can't boot, you can't read the file.
BitLocker vs Device Encryption (Windows 11 Home)
If you're on Windows 11 Home, you may already have Device Encryption running silently. Open Settings › Privacy & Security › Device Encryption to check. It uses the same underlying tech as BitLocker but skips the management options — you can't pick a separate PIN or change the encryption method, but the drive is still scrambled and tied to your Microsoft account.
For most home users in Murrayfield, Stockbridge or Bonnyrigg, that's enough. For a work laptop carrying client data, the full BitLocker on Windows 11 Pro is the right call.
Common BitLocker Problems We See
- BitLocker recovery screen after a Windows update. A genuine bug we've seen more than once. Enter the recovery key, log in, then run
manage-bde -protectors -enable C:in an admin PowerShell to suspend any future repeats. - Slow performance during initial encryption. Normal on older spinning drives. If your laptop crawls for hours, an SSD upgrade is usually the answer — see our NVMe vs SATA SSD guide.
- Locked out after a motherboard repair. Replacing the board breaks the TPM binding. Always suspend BitLocker before any major hardware work, and re-enable it once the repair is done.
When to Call a Pro
BitLocker is one of those features that's straightforward when it works and intimidating when something goes wrong. If your machine is asking for a recovery key you can't find, if you're seeing decryption errors, or if you simply want it set up properly across a small office in Musselburgh or Penicuik, we can help.
At PC Repair Services Edinburgh we handle BitLocker setup, recovery-key management and post-repair re-encryption every week as part of our software troubleshooting and business IT support services. If your drive has already failed and the data is critical, our data recovery service covers BitLocker-protected drives too — provided you still have the recovery key.
Whether it's a single laptop or a fleet of office machines, book a slot online or give us a ring and we'll get your data properly locked down.