I use and run admin level stuff for thousands of bit locker enabled devices world wide. Most of this is FUD.
Bitlocker requires TPM chip and Secure Boot enabled to encrypt. Funny this is also the same requirement to install Win11 (original version). There is a reg hack to bypass this on install. Just like there is a bypass for the new Bitlocker on install for 24h2.
With this change you have the option to turn it off at any time like all bitlocker installs. Assuming you have local admin rights to the system.
This is encrypted on your hard drive at rest. If you copy the files from your encrypted disk to another place. Like say uploaded to Google Drive, MEGA, etc. The file is not encrypted in Google or any other location. Say you copy the file from your bitlocker encrypted drive to your USB stick that is not bitlocker'd. Then that file is also NOT encrypted. If you move the file from one Encrypted drive to another. The OS will decrypt the file in memory. Move it to the new drive where it is then re-encrypted using that drives encryption setup.
Lots of misinformation about it.
The key piece that burns people is if they forget or loose the Recovery Key. Once and a while if something major changes on the system or if you have to mount the encrypted disk on another computer. You need to use a very long number key to unlock the drive. But my understanding is during the install of Win11 24H2 it will want you to login with a Microsoft Account. Much like how Apple wants iCloud accounts. When you link your Win11 box with your Microsoft Account then during the Bitlocker setup it will push the recovery key to Microsoft's cloud for safe keeping. And it will verity it's up in the cloud before it encrypts your local disk.
This tech has been used in enterprises for a long time now.
The only downfall is that yes you do take a disk i/o hit with encryption. so your disk is a bit slower. Tom's Hardware seems to think it's as much as 40% slower but I've not seen that in real life user deployed laptops.
