Thread by @atomicthumbs

...if you install Windows 11 with a local account instead of a Microsoft account, it still encrypts your drive with Bitlocker, but it keeps the key on the drive... in cleartext... until you sign in with a Microsoft account

This serves the dual purpose of making it difficult to recover your data, AND providing a false sense of security, since that Bitlocker key may well be compromised before you upload it to Microsoft

technical details: the VMK is the master key used for encrypting the FVEK, which actually encrypts the drive data. Usually the VMK is itself encrypted with a password, recovery password, smart card, etc, but in the case of Bitlocker suspension it's encrypted with a "clear key"

From this document. It's from 2011 but I doubt the basic architectural details of Bitlocker have changed csrc.nist.gov/csrc/media/pro…