I have Windows 10 Professional installed and have avoided the Anniversary Update until yesterday. The computer installed the update despite my best efforts to stop it. But that is a different problem.
I have Bitlocker configured to require a key stored in the TPM, another key stored on an Apricorn Aegis secure thumb drive, and a 20 character alpha-numeric pin, to boot the OS. When the Anniversary Update needed to reboot the machine, I prepared to provide the necessary key and pin but watched as the computer continued the update process without the required key file or pin. I saw the graphics card post screen, the raid post screen, and the motherboard post screen, but no Bitlocker pin screen. How is this possible? A reboot should clear the RAM, where the encryption keys are stored. How did the Anniversary Update application know how to read the encrypted hard drive without the key file or pin?
Was a recovery key written to the boot sector or Windows boot partition in an unencrypted state? Or was Bitlocker temporarily disabled? If so, how? Decrypting a file system takes a long time, even with four SSD's running RAID 0 (930GB usable space). The setup process for the update did not take long enough for such an operation, nor was there a lengthy re-encryption process at the end.
If a recovery key was written to the boot sector/partition, how do I determine if it has been securely wiped? Bare in mind, these are sold state drives that try to even out writes to disk to make the storage medium last longer. I need the specific blocks zeroed out that stored the recovery key. I have extremely sensitive data stored on this machine, and the slightest risk of this kind of vulnerability would require the physical destruction of all four SSD's.