Cloud-based removable drive encryption policy enforcement and recovery key management

A non-transitory computer-readable medium embodying instructions executable by at least one computing device, the instructions, when executed, causing the at least one computing device to at least:

• receive, by a management component executed by a client device, a removable drive encryption policy from a cloud-based management service;
• identify, by the management component, that a removable drive is recognized by an operating system of the client device;
• transmit, by the management component, at least one drive encryption command for the operating system, wherein the at least one drive encryption command causes the operating system to:
• request user password creation, and encrypt the removable drive;
• read, by the management component, password recovery data comprising a recovery key, the password recovery data is identified based at least in part on at least one write-output of the operating system;
• transmit, by the management component, the recovery key to the cloud-based management service for storage in a cloud-based removable drive recovery key escrow;
• identify, by the management component, that a password to decrypt the removable drive is forgotten;
• identify, by the management component, a recovery key identifier that is specific to the removable drive;
• and
• transmit, by the management component to the cloud-based management service, a recovery key request comprising the recovery key identifier, wherein the recovery key is identified from the cloud-based removable drive recovery key escrow.

A system, comprising:

• at least one computing device;
• and
• instructions accessible by the at least one computing device, wherein the instructions are executed causing the at least one computing device to at least:
• receive, by a management component executed by a client device, a removable drive encryption policy from a cloud-based management service;
• identify, by the management component, that a removable drive is recognized by an operating system of the client device;
• transmit, by the management component, at least one drive encryption command for the operating system, wherein the at least one drive encryption command causes the operating system to:
• request user password creation, and encrypt the removable drive;
• read, by the management component, password recovery data comprising a recovery key, the password recovery data is identified based at least in part on at least one write-output of the operating system;
• transmit, by the management component, the recovery key to the cloud-based management service for storage in a cloud-based removable drive recovery key escrow;
• identify, by the management component, that a password to decrypt the removable drive is forgotten;
• identify, by the management component, a recovery key identifier that is specific to the removable drive;
• and
• transmit, by the management component to the cloud-based management service, a recovery key request comprising the recovery key identifier, wherein the recovery key is identified from the cloud-based removable drive recovery key escrow.