Accessing Windows 11 drive that is protected by Bitlocker, but Secure Boot is disabled

Pre-Release Discussion
1

I’ve recently downloaded the UM 26.04 LTS Resolute Racoon Daily Build from Nov 19 2025, and saved that Live ISO on a USB stick.

lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=26.04
DISTRIB_CODENAME=resolute
DISTRIB_DESCRIPTION="Ubuntu Resolute Raccoon (development branch)"

I recently purchase an

for my wife. Note that the applicable OS version is

  • Windows 11 version 24H2 (64-bit)

Circumventing the “Secure Boot” is THE change in the context from previously doing backups from a Toshiba Qosmio using a Live Ubuntu onto a WD MyPassport external drive.

I used to be able to boot from the Live ISO on a USB stick, plug in an external WD MyPassport 2TB Backup Drive, and run a custom backup script for backing up either the full system image or just the Users folder.

Now after disabling the Secure Boot, I can get the option to boot from the stick,

  • using UM 26.04 LTS Daily Build Nov 19 2025,

which is successful, but, because Bitlocker is “in control”, when I try to mount the internal SSD, it shows “bitlocker” as “file type”, but that is not a filesystem type that is recognized by “mount” … and I can’t access the data on that internal drive (Windows C: drive).

BTW, the computer shows me the Bilocker key string, but the strange thing is that when I try typing that in, it only accepts/recognizes digits … and none of the letters (upper or lower) or hyphens!!!

Can someone point me to a sequence of steps (hopefully in some task-oriented PDF) that will show me what to do in order to have the mount command allow me to make that drive available to me?

Would this be considered an Ubuntu-level issue, or an HP UEFI Security issue?

IF it is an HP issue, can someone please point me to the correct forum for seeking the necessary assistance?


(Unrelated to issue, but included as background material for context)

My Backup Script (work-in-progress):

#!/bin/sh

	echo "\n\t Plug in 'My Passport' USB Backup drive ...\n\n\t Hit return to continue when ready ...\c" ; read k
	echo "\n\t Hit return again to confirm ...\c" ; read k


###
###	GUIDANCE
###
###	Values for UUID_data and UUID_bkup must be specifically identified
###	and hardcoded for using this script on any new computer.
###


###
###	UUID for computer's primary internal disk drive partition
###
#UUID_data="5dcf1a96-fa2e-42f5-9a08-37fcce0f0878"	###	OasisMega1
UUID_data="B0E2A6C7E2A69160"				###	Toshiba Qosmio


###
###	UUID for external USB Backup Drive partition
###
UUID_bkup="C0E29556E2955210"




###
###	Scan for access to physical internal drive
###

###
###	***  COMPARE & CONFIRM ***      IS  /dev/sda2  the REAL USER DATA PARTITION ???
###
###	root@ubuntu-mate:/media/ubuntu-mate/My Passport/bin__Qosmio/OLDER# blkid
###	/dev/sda1: LABEL="System" UUID="5270809670808289" TYPE="ntfs" PARTUUID="26bfe9e3-01"
###	/dev/sda2: LABEL="S3A5801D002" UUID="B0E2A6C7E2A69160" TYPE="ntfs" PARTUUID="26bfe9e3-02"
###	/dev/sda3: LABEL="HDDRECOVERY" UUID="ACF2CD1AF2CCEA22" TYPE="ntfs" PARTUUID="26bfe9e3-03"



###	Phase I
lsblk -P -p -o NAME,FSTYPE,PARTLABEL,UUID | grep -v 'GRUB' | awk  '/[/]dev[/]sd[a-z][0-9]/ { print $0 }' | grep '/dev/sda2'
echo "\n\t PLEASE CONFIRM MATCH of 'PARTLABEL' value against report from 'gparted' for computer's internal disk, then hard-code the UUID for that partition as 'UUID_data'.\n\n Bye!\n" ; exit
###	Comment out the above Phase I upon successful completion of those steps.



###	Phase II
lsblk -P -p -o NAME,FSTYPE,PARTLABEL,UUID | grep -v 'GRUB' | awk  '/[/]dev[/]sd[a-z][0-9]/ { print $0 }' | grep 'UUID="'${UUID_data}'"' | awk '{ print $1 }' | cut -f2 -d\"
echo "\n\t PLEASE CONFIRM that the correct device file is being reported as expected, for the primary User partition on the computer's internal disk.\n\n Bye!\n" ; exit
###	Comment out the above Phase II upon successful completion of those steps.



DEVICE_data=`lsblk -P -p -o NAME,FSTYPE,PARTLABEL,UUID | grep -v 'GRUB' | awk  '/[/]dev[/]sd[a-z][0-9]/ { print $0 }' | grep 'UUID="'${UUID_data}'"' | awk '{ print $1 }' | cut -f2 -d\" `

if [ -n "${DEVICE_data}" ]
then
	echo "\n\t Connectivity and visibility of PRIMARY DISK DRIVE is confirmed ...\n"
else
	echo "\n\t Internal PRIMARY DISK DRIVE is NOT physically accessible to the computer.\n\n\t INVESTIGATION REQUIRED!\n"
	exit 1
fi

###
###	Scan for access to physical backup drive
###

DEVICE_bkup=`lsblk -P -p -o NAME,FSTYPE,PARTLABEL,UUID | grep -v 'GRUB' | awk  '/[/]dev[/]sd[a-z][0-9]/ { print $0 }' | grep 'UUID="'${UUID_bkup}'"' | awk '{ print $1 }' | cut -f2 -d\" `

if [ -n "${DEVICE_bkup}" ]
then
	echo "\n\t Connectivity and visibility of USB BACKUP DRIVE is confirmed ...\n"
else
	echo "\n\t External USB BACKUP disk is NOT physically accessible to the computer.\n\n\t MANUAL INTERVENTION REQUIRED!\n"
	exit 1
fi

exit 1
	echo "\n\t Hit return again to confirm ...\c" ; read k
	echo "\n\t Hit return again to confirm ...\c" ; read k


### root@ubuntu-mate:/media/ubuntu-mate/HDDRECOVERY# tar cf - . | ( cd "${there}" ; tar xvpf - )
mountUser="ubuntu-mate"			### Shared variable

###################################################################################
###################################################################################
data_to_USB_common()
{
	echo "\n BACKUP DESTINATION = '${THERE}' ...\n"

	if [ -d "${MOUNTP_bkup}" ]
	then
		if [ ${doUser} -eq 1 ]
		then
			echo "\n\t create dir loop u ..."
			cd "${MOUNTP_bkup}"
			mkdir -v "${THERE}_u"
			cd "${THERE}_u"
			pwd
		fi

		if [ ${doWind} -eq 1 ]
		then
			echo "\n\t create dir loop s ..."
			cd "${MOUNTP_bkup}"
			mkdir -v "${THERE}_s"
			cd "${THERE}_s"
			pwd
		fi

		cd "${MOUNTP_bkup}"

		echo "\n Report of files at ROOT for backup directories:"
		ls -ltr | awk '{ printf("\t %s\n", $0 ) ; }'
		echo "\n Hit return to continue\c" ; read k <&2 ; echo ""
	fi

	if [ -d "${MOUNTP_data}" ]
	then
		cd "${MOUNTP_data}"

		echo "\n Report of files at ROOT of data being backed up:"
		ls -ltr | awk '{ printf("\t %s\n", $0 ) ; }'
		echo "\n Hit return to continue\c" ; read k <&2 ; echo ""
	fi

	if [ ${doUser} -eq 1 ]
	then
		echo "\n Doing PHASE I - User Data ..."
		echo "\t Doing 'Users' ..."
		rm -f logfile.txt
		touch BK_start
		cd "${MOUNTP_data}" ; tar cf - Users | ( cd "${THERE}_u" ; tar xvpf - >logfile.txt )
		touch BK_end
		echo "\n\n PHASE I (User Data) - BACKUP DONE!\n\n"
	else
		echo "\t Skipping 'Users' ..."
	fi


	if [ ${doWind} -eq 1 ]
	then
		echo "\n Doing PHASE II - System Data ..."

		echo "Windows" >"${SYSLIST}"
		ls | grep -v '^Windows' | grep -v '^Users' | grep -v 'hiberfil.sys' | grep -v 'pagefile.sys' >>"${SYSLIST}"

		if [ -s "${SYSLIST}" ]
		then
			echo "\n\t Hit return to edit the list of files for SYSTEM-ONLY backup\n Ensure 'Windows' is on first line of the list ..." ; read k
			vi "${SYSLIST}"

			echo "\n\t Hit return to continue (or break to abandon) ..." ; read k

			count=`wc -l "${SYSLIST}" | awk '{ print $1 }' `
			cd "${MOUNTP_data}"
			rm -f logfile.txt
			touch BK_start
			while read line
			do
				echo "\t [${count}] Doing '${line}' ..."
				tar cf - "${line}"  | ( cd "${THERE}_s" ; tar xvpf - >>logfile.txt )
				count=`expr ${count} - 1 `
			done <"${SYSLIST}"
			touch BK_end
			echo "\n\n PHASE II (System Data) - BACKUP DONE!\n\n"
		else
			echo "\n\t ERROR:  SYSLIST file '${SYSLIST}' is empty!  Unable to proceed!\n Bye!\n" ; exit 1
		fi
	else
		echo "\t Skipping backup of Windows OS ..."
	fi

	echo "\n\n\t\t BACKUP JOB COMPLETED!\n\n"

	exit
	exit
	exit
}



###################################################################################
###################################################################################
shared_setup()
{
	###
	### MOUNT POINT of ROOT partition
	###
	diskR=`df | awk '{ if( $6 == "/" ){ print $1 } }' `
	echo ${diskR}


	###
	### MOUNT POINT
	###
	MOUNTP_data="/media/${mountUser}/internaldisk"


	if [ -d "${MOUNTP_data}" ]
	then
		echo "\n\t Mount point for INTERNAL disk ... EXISTS ...\n"
	else
		echo "\n\t Mount point for INTERNAL disk ... MISSING ...\n"
		mkdir -v "${MOUNTP_data}"

		if [ -d "${MOUNTP_data}" ]
		then
			ls -ld "${MOUNTP_data}"
			echo "\n\t Mount point for INTERNAL disk ... CREATED ...\n"
		else
			echo "\n\t FAILED to create mount point for INTERNAL disk!\n"
			ls -ld /media
			ls -l /media
			echo "\n\t MANUAL INTERVENTION REQUIRED!\n"
			exit 1
		fi
	fi

	diskD=`df "${MOUNTP_data}" 2>>/dev/null | awk '{ print $1 }' `


	###
	### PARTITION ACCESSIBILITY
	###
	if [ -n "${diskD}" ]
	then
		if [ "${diskD}" = "${diskR}" ]
		then
			echo "\n\t INTERNAL disk is not mounted.\n"
			ls -ld /media
			ls -ld "${diskD}"
			echo "\n\t MANUAL INVESTIGATION REQUIRED!\n"
			exit 1
		fi
		echo "\n\t CONFIRMED:  INTERNAL disk mounted ...\n"
	else
		echo "\n\t Partition for INTERNAL disk is ... NOT MOUNTED ...\n"

		mount -v -t ntfs --uuid="${UUID_data}" "${MOUNTP_data}"
		#mount -v -t ntfs "${DEVICE_data}" "${MOUNTP_data}"

		diskD=`df "${MOUNTP_data}" 2>/dev/null | awk '{ print $1 }' `

		if [ -n "${diskD}" ]
		then
			if [ "${diskD}" = "${diskR}" ]
			then
				echo "\n\t INTERNAL disk is not mounted.\n"
				ls -ld /media
				ls -ld "${diskD}"
				echo "\n\t MANUAL INVESTIGAION REQUIRED!\n"
				exit 1
			fi
			echo "\n\t Partition for INTERNAL disk is ... MOUNTED ...\n"
		else
			echo "\n\t FAILED to mount partition for INTERNAL disk\n\t\t at => ${MOUNTP_data} !\n"
			ls -ld /media
			ls -l /media
			echo "\n\t MANUAL INTERVENTION REQUIRED!\n"
			exit 1
		fi
	fi


	###
	### MOUNT POINT
	###
	MOUNTP_bkup="/media/${mountUser}/My Passport"


	if [ -d "${MOUNTP_bkup}" ]
	then
		echo "\n\t Mount point for BACKUP disk ... EXISTS ...\n"
	else
		echo "\n\t Mount point for BACKUP disk ... MISSING ...\n"
		mkdir -v "${MOUNTP_bkup}"

		if [ -d "${MOUNTP_bkup}" ]
		then
			ls -ld "${MOUNTP_bkup}"
			echo "\n\t Mount point for BACKUP disk ... CREATED ...\n"
		else
			echo "\n\t FAILED to create mount point for BACKUP disk!\n"
			ls -ld /media
			ls -l /media
			echo "\n\t MANUAL INTERVENTION REQUIRED!\n"
			exit 1
		fi
	fi

	diskB=`df "${MOUNTP_bkup}" | awk '{ print $1 }' `


	###
	### PARTITION ACCESSIBILITY
	###
	if [ -n "${diskB}" ]
	then
		if [ "${diskB}" = "${diskR}" ]
		then
			echo "\n\t BACKUP disk is not mounted.\n"
			ls -ld /media
			ls -ld "${diskB}"
			echo "\n\t MANUAL INVESTIGAION REQUIRED!\n"
			exit 1
		fi
		echo "\n\t CONFIRMED:  BACKUP disk mounted ...\n"
	else
		echo "\n\t Partition for BACKUP disk is ... NOT MOUNTED ...\n"

		mount -v -t ntfs --uuid="${UUID_bkup}" "${MOUNTP_bkup}"
		diskB=`df "${MOUNTP_bkup}" 2>/dev/null | awk '{ print $1 }' `

		if [ -n "${diskB}" ]
		then
			if [ "${diskB}" = "${diskR}" ]
			then
				echo "\n\t BACKUP disk is not mounted.\n"
				ls -ld /media
				ls -ld "${diskB}"
				echo "\n\t MANUAL INVESTIGAION REQUIRED!\n"
				exit 1
			fi
			echo "\n\t Partition for BACKUP disk is ... MOUNTED ...\n"
		else
			echo "\n\t FAILED to mount partition for BACKUP disk\n\t\t at => ${MOUNTP_bkup} !\n"
			ls -ld /media
			ls -l /media
			echo "\n\t MANUAL INTERVENTION REQUIRED!\n"
			exit 1
		fi
	fi

	TODAY=`date '+%Y%m%d-%H%M' `
}



###################################################################################
###################################################################################
data_to_bkup()
{
	shared_setup

	THERE="${MOUNTP_bkup}/SNAPSHOTs__Diane/Backup_Diane_${TODAY}" 
	HERE="${MOUNTP_data}"

	echo "\n\t Source (HERE)  = '${MOUNTP_data}' \n\t Target (THERE) = '${THERE}' \n\n Hit return to continue, or break to terminate\n" ; read k <&2

	echo "\n Do BACKUP of User data ? [y/N] => \c"
	read ans
	if [ -z "${ans}" ] ; then ans="N" ; fi
	case "${ans}" in
		y* | Y* )	doUser=1 ;;
		* )		doUser=0 ;;
	esac

	echo "\n Do BACKUP of Windows data ? [y/N] => \c"
	read ans
	if [ -z "${ans}" ] ; then ans="N" ; fi
	case "${ans}" in
		y* | Y* )	doWind=1
				SYSLIST="/media/${mountUser}/My Passport/BKlist_SYSTEM.txt"
				;;

		* )		doWind=0 ;;
	esac

	data_to_USB_common

	exit
	exit
	exit
}
data_to_bkup



###################################################################################
###################################################################################
data_to_FAILSAFE()
{
	shared_setup

	THERE="${MOUNTP_bkup}/SNAPSHOTs__Diane/FAILSAFE_Diane_${TODAY}" 
	HERE="${MOUNTP_data}"

	echo "\n Do BACKUP of User data ? [y/N] => \c"
	read ans
	if [ -z "${ans}" ] ; then ans="N" ; fi
	case "${ans}" in
		y* | Y* )	doUser=1 ;;
		* )		doUser=0 ;;
	esac

	echo "\n Do BACKUP of Windows data ? [y/N] => \c"
	read ans
	if [ -z "${ans}" ] ; then ans="N" ; fi
	case "${ans}" in
		y* | Y* )	doWind=1
				SYSLIST="/media/${mountUser}/My Passport/FAILSAFE_SYSTEM.txt"
				;;

		* )		doWind=0 ;;
	esac

	data_to_USB_common

	exit
	exit
	exit
}
#data_to_FAILSAFE



###################################################################################
###################################################################################
data_fr_bkup()
{
	shared_setup

	HERE="${MOUNTP_bkup}/SNAPSHOTs__Diane/Backup_Diane_20230829-1529_u"
	THERE="${MOUNTP_data}"

	ls -l "${HERE}"
	echo "\n PWD = `pwd`"

	echo "\n"
	ls -l "${THERE}"

	cd "${HERE}" ; tar cf - Users | ( cd "${THERE}" ; tar xvpf - )

	exit 0
	exit 0
	exit 0
}
#data_fr_bkup


exit
exit
exit

I haven’t had a chance to try it yet, but I am on the verge of making an attempt with a purely Windows batch script that I created, as follows, IF I can’t get Ubuntu to read that (encrypted?) disk:

REM Extract components and format the timestamp
SET YYYY="%dt:~0,4%"
SET MM="%dt:~4,2%"
SET DD="%dt:~6,2%"
SET HH="%dt:~8,2%"
SET MM="%dt:~10,2%"
SET SS="%dt:~12,2%"

SET BkRoot="SNAPSHOTs__eajma"
SET BkType="BackupHP_FULL"
SET BkType="BackupHP_eajma"

SET SDIR="C:\"
SET DDIR="F:\%BkRoot%\%BkType%_%YYYY%%MM%%DD%-%HH%%MM%"
SET LOGF="%DDIR%.log"

SET MAIN_OPTIONS="/B /Z /ZB /COPY:DATS /MIR /R:20 /W:10"
SET LOG_OPTIONS="/FP /V /TEE /LOG:%LOGF%"

::
:: robocopy C:\ F:\SNAPSHOTs__eajma\BackupHP_FULL_20251214-1743 /B /Z /ZB /COPY:DATS /MIR /R:20 /W:10 /FP /V /TEE /LOG:F:\SNAPSHOTs__eajma\backup_log.txt
::

robocopy.exe "%SDIR%" "%DDIR%" %MAIN_OPTIONS% %LOG_OPTIONS%

::	
::	/ZB		# Use restartable mode; if access denied use Backup
::	/B		# Backup Mode
::	/Z		# Restartable Mode
::	/COPY:DATS	# D=Data, A=Attributes, T=Timestamps, S=Security=NTFS ACLs
::	
::	#/E		# Copy subfolders including empty subfolders
::	#/PURGE		# Delete dest files/folders that no longer exist in source
::	/MIR 		# /E /PURGE
::	
::	/R:20		# Number of retries on failed copies 
::	/W:10		# Wait time between retries
::	
::	/FP		# Replaces simple file names with full file pathnames in the output.
::	/V		# Produce verbose output log, showing skipped files
::	/TEE		# Output to console window, as well as the log file
::	/LOG:F:\SNAPSHOTs__eajma\backup_log.txt		# Output status to log file and overwrite
::
2

Moved to Pre-Release Discussion since 26.04 is still in development

Usually, to dual boot on the same disk, you have to disable Bitlocker
More information here

1 Like
3

Bitlocker is Microsoft’s disk encryption. So you need a program that can decrypt it and a key. There is a program called ‘dislocker’ in the repositories that supposedly can handle Bitlocker in all variants from Windows Vista to Windows 10. It’s a FUSE file system. I don’t know whether it can handle the version of Bitlocker used by Windows 11, but there’s no issues on the github page that mention any problems.

1 Like
4

Thank you very much for replying.

It looks like it might not be just a simple use of dislocker.

If you enter the following as a query in google,

Linux How do I bypass Bitlocker in order to access the Windows C: drive on an HP S03-0059 PC using a Live Linux ISO USB stick

would you be willing to comment on whether the process outlined is actually workable?

OR

Is the following actually possible?

Alternative: Suspend BitLocker from within Windows

If the PC can still boot into Windows, the easiest method is to suspend BitLocker protection temporarily from the Windows Control Panel before attempting to boot into Linux. This way, the TPM won’t lock the drive, and you can access it directly from the Live Linux environment without needing the key or dislocker.

5

How do you think I found out about dislocker ? I entered ‘access Bitlocker drive from Linux’ into duckduckgo and the first hit was a tutorial at baeldung. I have almost no experience with Bitlocker; my computers are all Windows-free; I only see that OS from afar on the systems of friends and relatives.

6

Its a Windows bitlocker issue.

I have seen users post that they were able to turn bitlocker off, install Ubuntu and turn it back on. You have to shrink the NTFS partition and I am not sure you can do that from Linux with bitlocker on. Always best to use Windows tools to shrink NTFS partitions.

An alternative is an external SSD, and put full install onto it.

My Dell required repair and when it came back, Ubuntu worked, but Windows did not. No Windows fixes worked, only total reinstall of just Dell image which erased my Kubuntu. Used external SSD That is full install and backup of desktop and found it worked just as well as internal drive. I am back to dual booting on laptop as mostly Kubuntu user, but consider install on external SSD drive as main fallback. And laptop is only for travel & Windows only for tax software. Perfer my desktop system.

1 Like
7

Thank you, Fred.

To clear things up, I do NOT want to install Linux on a partition on the internal drive.

I ONLY want to be able to access the bitlocked drive from Ubuntu on a USB stick, in order to run my backup script to capture all the files, without Windows interfering with “File busy” or “File not available”.

My current concern is that, although people indicate that bitlocker could be turned off, that action is a one-way action, which may not be reversable, and I can’t afford for my wife’s data, for which I now don’t have backups, become a guinea pig to the possibility of not being able to access the drive if I boot back up into Windows.


Don’t know if anyone has a reference to an HP-specific support site to help with UEFI Secure Boot, Bitlocker and Linux access to such protected drives in a “wholistic” fashion, not via networking?

:frowning:

8

The best way to access the locked drive is to clone the drive and attempt a decode with code number one. If that doesnt work then clone again and then try code number two. Repeat until you remember or guess the correct code… I don’t know why anyone would want bitlocker if it could be opened any other way.