Encrypt a Windows 11 external backup drive without losing its recovery route

An external backup protects against failure of the PC's internal drive, but a lost portable disk can expose private files. BitLocker To Go encrypts removable data drives on supported Windows editions and can unlock them with a password or smart card. Encryption adds a new dependency: if you lose both unlock credential and recovery key, the backup becomes unusable. Set it up, store recovery separately, then perform a real unlock and restore test.

Before you start​

Check that your Windows edition and organization policy permit BitLocker To Go. Back up the drive's existing contents before enabling encryption and confirm it is the correct drive. Choose a strong unique unlock passphrase and a safe key-storage location outside that disk. Keep a second copy of irreplaceable data; encryption does not prevent physical drive failure.

Do it step by step​

1. Connect the external drive and open Control Panel > BitLocker Drive Encryption. Identify the removable drive by capacity and label before choosing Turn on BitLocker.
2. Choose the supported unlock method and save the recovery key to a separate secure location. Do not store its only copy on the encrypted backup drive.
3. Complete encryption while the drive remains connected and power is stable. Label the disk without writing the password or key on the label.
4. Copy a few representative backup files and safely eject the drive. Reconnect it and unlock it using the intended passphrase or smart card.
5. On a second trusted Windows PC, confirm the drive unlocks and the sample files open. Test recovery-key access privately without exposing the secret in support screenshots.
6. Run or update the actual backup job, record its date and store the drive securely and disconnected when not needed.

Check the result​

The external disk unlocks on another trusted PC, contains restorable files and has a recovery route independent of the original computer.

If something goes wrong​

If encryption is unavailable, verify edition, file system and policy rather than downloading a fake BitLocker enabler. If unlocking fails, match the recovery-key ID to the correct drive and use the stored key; do not format the disk to clear a prompt.

Know the limit​

BitLocker To Go protects confidentiality if the drive is lost. It does not defend against deleting files while unlocked, ransomware on a connected PC or loss of the only recovery key. Microsoft BitLocker To Go FAQ

Decision checkpoint​

Encryption is useful only when the recovery procedure is known. Test unlocking without the original PC, including access to the stored recovery key. Keep the key in a secure password manager or other approved location distinct from the drive. If the backup belongs to an organization, follow its key-escrow and retention rules rather than a personal account. Remember that an encrypted but always-connected drive is still writable after unlock.

Aftercare​

Disconnect the backup drive after a successful job and store it securely. Periodically unlock it on another trusted PC so a forgotten password or misplaced key is found early.