What is XTS‑AES 256‑bit encryption?

XTS is a mode of operation designed for disk encryption. It encrypts data by sector and resists manipulation by binding encryption to the physical layout of the disk.

AES 256‑bit uses a 256‑bit key, offering extremely strong protection against brute‑force attacks and aligning with modern enterprise standards.

Combined, XTS‑AES 256 is the industry standard for full‑disk and volume encryption, used by tools like BitLocker and VeraCrypt to protect sensitive archives.

“The capsule holds the scrolls, the cipher seals them — together they become unbreakable legacy.”

What is the default in Windows?

By default, BitLocker uses XTS‑AES 128‑bit encryption for new volumes. It’s efficient and secure, but archivists often choose XTS‑AES 256‑bit for maximum resilience and future‑proofing.

Enable XTS‑AES 256‑bit with Group Policy (system‑wide default)

1. Press Win + R, type gpedit.msc, and press Enter.
2. Navigate to:
   Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption
3. Open Choose drive encryption method and cipher strength for each drive type you use.
4. Set the policy to Enabled and choose XTS‑AES 256‑bit.
5. Apply and restart Windows.

Enable XTS‑AES 256‑bit with PowerShell (per‑drive ritual)

BitLocker requires a protector (password, recovery key, TPM, etc.). The correct ritual is a three‑step sequence:

Step 1: Enable BitLocker with a password protector

Enable-BitLocker -MountPoint "Y:" -PasswordProtector -EncryptionMethod XtsAes256
    

Step 2: Add a recovery key protector

Add-BitLockerKeyProtector -MountPoint "Y:" -RecoveryPasswordProtector
    

Step 3: Verify encryption and protectors

Get-BitLockerVolume -MountPoint "Y:"
    

Replace Y: with your drive letter. This ensures the capsule is sealed with XTS‑AES 256‑bit and has redundant unlock methods.

Optional: Create and encrypt a VHD capsule

1. Create VHD: Open Disk Management → Action → Create VHD → choose location/size → initialize (GPT) → format (NTFS).
2. Assign a drive letter (e.g., Y:).
3. Encrypt with the three‑step PowerShell ritual above.
4. Save the recovery key to an offline location (print or store in a separate, secured archive).

Verify BitLocker Encryption Strength

You can confirm whether a drive is sealed with XTS‑AES 128 or XTS‑AES 256 using these commands:

PowerShell

Get-BitLockerVolume -MountPoint "Y:" | fl
  

Command Prompt

manage-bde -status Y:
  

Replace Y: with your drive letter. Both commands will display the Encryption Method, showing whether the capsule is protected with XTS‑AES 128 or XTS‑AES 256.

Troubleshooting common errors

• Access denied: Run PowerShell as Administrator.
• Not associated with BitLocker volume: Ensure the drive is mounted, initialized, and formatted.
• Parameter set cannot be resolved: Only one protector can be used with Enable-BitLocker. Add others afterwards with Add-BitLockerKeyProtector.