REVIEWED by Sophos
The first query will show for Windows devices if any drive has been encrypted using BitLocker:
select drive_letter as "Drive Letter",
case protection_status when "1"
then "ENABLED"
else "DISABLED"
end "Protection Status",
encryption_method "Encryption Method" from bitlocker_info
where drive_letter LIKE "_:"
The second query will identify drives that have been encrypted utilizing hardware encryption via BitLocker:
select drive_letter as "Drive Letter",
case protection_status when "1"
then "ENABLED"
else "DISABLED"
end "Protection Status",
encryption_method "Encryption Method" from bitlocker_info
where drive_letter LIKE "_:" AND encryption_method like 'HARDWARE%'
These drives could be affected by a security risk which was discovered by the Radboud University, see: https://community.sophos.com/kb/en-us/133070.
