Hide Files on Local Drive (BitLocker Vault)
To protect local files, create a separate virtual disk, format it, and turn on BitLocker for its volume. Keep its recovery key somewhere separate and verify that you can retrieve it. When the volume is locked, its contents are encrypted. The container’s name and size may still be visible, so hiding a drive letter is not the security measure.
A successful setup keeps private files out of casual view while making them available when you need them. I recommend treating this as an encryption project, not a hiding trick: the protection comes from BitLocker locking the volume, not from a quiet filename or an obscure location.
The steps below use Windows tools and a VHDX, a virtual disk stored as a file on your local drive. Check your Windows edition first. BitLocker management is included with Pro, Enterprise, and Education editions. Some supported Home devices offer Device Encryption, but that is not the same as having the full BitLocker management interface for a separate volume.
Planning the Encrypted Local Vault
An encrypted local vault is a separate volume that you unlock when you need its files and lock when you are done. A VHDX can hold that volume as one file on your drive. BitLocker protects the contents when locked, but does not make the VHDX itself invisible.
Before creating anything, confirm you have administrator access, enough free storage, and a safe place for the recovery key. Pick a container name that you can recognize, but do not treat a neutral name as protection. A person who can browse the host drive may still see the VHDX filename and its size.
Choose a maximum size based on the files you plan to store, with room for expected growth. A dynamically expanding VHDX uses space as data is added, up to its set maximum. A fixed-size VHDX reserves its full size when created. In either case, keep enough free space on the host drive for normal Windows use and backups.
BitLocker supports XTS-AES 128-bit and 256-bit encryption. Use an available option that matches your organization’s policy; do not change a managed computer’s settings without checking with its administrator. XTS-AES protects data on the volume, but it does not hide file names from someone who can unlock and browse it.
A TPM, or Trusted Platform Module, can help protect startup keys. BitLocker does not require a TPM for every setup, although using startup protection without one can require policy changes and may be less convenient. A TPM does not replace a recovery key.
Access, Mounting, and Recovery-Key Checks
Access planning means confirming how you will open the VHDX and unlock its BitLocker volume before putting important files inside. A recovery key is the backup unlock method, not an optional note. Keep it separate from the container and verify you can retrieve it before relying on the vault.
On Windows Pro, Enterprise, or Education, open Disk Management as an administrator. In the Action menu, choose Create VHD, select a local path ending in .vhdx, set its maximum size, and choose dynamically expanding or fixed size. After creation, use Action > Attach VHD, then initialize the new disk, create a volume, and assign a drive letter.
A BitLocker recovery password has 48 digits. Save it to a secure location separate from the protected volume, such as an approved password manager or another protected device. Do not save it beside the VHDX or only in the same account that holds the container. If both the unlock credential and recovery key are lost, the data may be unrecoverable.
| Choice or check | What it means | Practical use |
|---|---|---|
| Dynamic VHDX | The host file grows as data is added, up to its maximum size. | Useful when you want to avoid reserving the full capacity at setup. |
| Fixed VHDX | The host file reserves its full size at creation. | Useful when you want predictable allocated storage and have enough space. |
| Recovery password | A 48-digit BitLocker recovery credential. | Store separately and test retrieval before copying valuable files. |
| Assigned drive letter | A way to access the mounted volume in File Explorer. | Convenient, but not a security control. |
If Windows Home is installed, check Settings > Privacy & security > Device encryption and confirm what controls your edition provides. Do not assume that Device Encryption lets you create and manage a separate BitLocker-protected VHDX in the same way as the full BitLocker interface. If the needed controls are absent, use a supported Windows edition or another encryption product approved for your needs.
Creating and Encrypting the Vault
Creating the vault means making a VHDX, formatting its volume, then enabling BitLocker on that volume. Encrypt the empty volume before copying sensitive files into it. This order makes it easier to confirm encryption and recovery access first, rather than finding out during a file move that the setup is incomplete.
In Disk Management, attach the VHDX if it is not already attached. If Windows asks to initialize the disk, choose GPT for a modern Windows setup, then create a new simple volume, format it with NTFS, and assign a drive letter. Confirm the volume appears in File Explorer and that its available capacity matches your plan.
Next, enable BitLocker on the new drive. In File Explorer, right-click the volume and select Turn on BitLocker, then follow the prompts. Choose an available XTS-AES option if asked, save the recovery key to a separate secure place, and complete the encryption process. Keep the recovery key out of the VHDX itself.
You can check status from an elevated Command Prompt with:
manage-bde -status X:
Replace X: with the vault’s drive letter. The output reports the volume’s conversion status, protection status, and encryption method. Wait until encryption has finished before treating the vault as ready. You can also review BitLocker volumes in an elevated PowerShell window:
Get-BitLockerVolume
Only after encryption is on and you have checked the recovery key should you copy files into the mounted volume. Open a few files from their new location to confirm they work. Then check that you did not leave extra copies in Downloads, desktop folders, email attachments, or application export folders.
Lock-State and Recovery Verification
A lock-state check confirms that the volume’s contents cannot be opened while BitLocker is locked and that an authorized user can unlock them again. Do this before deleting any original files. Remember that BitLocker protects data at rest; it does not block access while the volume is unlocked and mounted in your logged-in Windows session.
Close files and apps that use the vault. Lock the BitLocker volume, then detach the VHDX in Disk Management. From an elevated Command Prompt, you can request a lock with:
manage-bde -lock X:
If files are still open or the volume cannot lock, close the applications using it and retry. Once the VHDX is detached, confirm its contents are not available through the old drive letter. Attach it again, unlock it using your normal method, and confirm you can open a test file.
A common mistake is to test only the unlock password and never test recovery-key access. Verify that you can retrieve the 48-digit key from its separate storage. Do not share it in a message or store it next to the container. Keep backups encrypted too, and test that you can restore them before removing source copies.
Representative scenario: A homeowner wants to store scanned records and a small set of private documents on a laptop. They create a VHDX, encrypt its volume, save the recovery key in a separate secure account, and test locking and unlocking before moving files. This workflow limits casual access to the locked volume, but it does not erase copies kept in backups or other folders.
Small-business scenario: A staff member stores work files in a VHDX on a company-managed Windows PC. The organization should set the encryption method, recovery-key storage, and backup rules; a personal setup should not override those policies. If several staff need access, agree on approved access and recovery procedures before using the vault.
The main operational limit is simple: when the volume is unlocked, a person or malicious program running with access to your Windows session may be able to read its files. Lock it when you finish, and shut down the device when that better fits your threat model. Also remember that encryption does not remove source copies, application caches, or files already copied into backups.
Frequently Asked Questions
These answers cover common setup and use questions for a local BitLocker volume. The key distinction is between hiding a drive from casual view and encrypting its contents. Use the checks below to confirm what BitLocker protects, what remains visible, and how to avoid losing access to files.
Does BitLocker hide the VHDX file?
No. BitLocker protects the contents of its encrypted volume while locked. The VHDX container can still appear in the folder where it is stored, including its name and file size.
Does removing the drive letter secure the files?
No. An unassigned drive letter is not encryption. Use BitLocker to protect the volume, then lock it when you are finished.
Can I use this setup on Windows Home?
It depends on the device and available features. Some Home devices support Device Encryption, but Home does not provide the same general BitLocker management interface as Pro, Enterprise, or Education. Check your Windows settings before planning a separate encrypted volume.
How long is the BitLocker recovery password?
It is 48 digits. Store it separately from the VHDX and verify that you can retrieve it before moving important files into the vault.
What happens if I lose the recovery key?
If you cannot unlock the volume and have also lost the recovery key, the data may be unrecoverable. Keep recovery information secure, separate, and accessible to an authorized person.
Can I store the recovery key inside the vault?
Do not. If the vault is locked, the key inside it is unavailable. If the container and key are found together, the separation meant to protect the data is also lost.
Does BitLocker protect files while I am using them?
BitLocker protects the volume while locked. When the volume is unlocked, files are available to your Windows session and may also be accessible to software running with suitable permissions.
Does deleting the original file remove every copy?
No. A file may remain in backups, sync services, email, temporary folders, or application caches. Moving a file into the vault does not automatically remove those copies.
Should I delete the original after testing the vault?
Only after checking that encryption is complete, the recovery key is retrievable, and the copied files open correctly. Keep an encrypted backup if the files matter; do not rely on the vault as the only copy.
How do I confirm the volume is encrypted?
Run manage-bde -status X: in an elevated Command Prompt, replacing X: with the volume letter. Check that encryption is complete and protection is on before relying on the vault.
(This article was written by one of our staff writers, Richard Montclair. Visit our Meet the Team page.)
