Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Naturally I feel that I have to ask this question, since it's a built-in feature in Windows. Let's say someone has physical access to my PC, is there an easy way for them to access a BitLocker protected drive without physically tampering with the PC (such as hardware keyloggers)?

share|improve this question

6 Answers 6

up vote 2 down vote accepted

There is currently only one cold boot attack I know of that works against bitlocker. However it would need to be executed seconds after the computer has been turned off (it can be extended to minutes if the DRAM modules are cooled down significantly) but due to the timeframe of execution it's rather implausible. Bitlocker is secure as long as your machine is completely turned off when you store it (hibernate is also ok, but sleep needs to be disabled).

share|improve this answer
Note that cold boot attacks are not specific to BitLocker, but can attack any of the commonly used disc encryption systems. There has been some efforts to keep the encryption key out of the RAM, like TRESOR (www1.informatik.uni-erlangen.de/tresor), but those are not ready for productive use yet. –  Perseids Aug 11 '13 at 16:31
If the machine is off, there are no non-physical attacks that are effective. Network based attacks require a machine to be available on a network. –  this.josh Aug 12 '13 at 6:35
→ Lucas, you are answering on the physical access risk & the OQ is focused on this risk. But this is the "north face" for heroes & I-agencies. –  daniel Azuelos Jul 7 at 21:00

There is also the "Evil Maid" attack that could, in theory be used against any software disk encryption, as the boot loader needs to still be unencrypted. See Bruce Schneier's article about it from 2009. http://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html

The general gist of the "Evil Maid" attack is that someone gets ahold of your laptop for a few minutes when it is unattended (for example, in your hotel room, hence the name) and loads a hacked bootloader into it. You then log in with your password via the hacked boot loader and it unlocks the drive, but also writes your password to a .txt file in the unencrypted part of the HDD. You leave your laptop alone again, they steal it with the password.

share|improve this answer
I use an SSD as a system drive, and then I have another drive for my files. I planned to leave the SSD unencrypted and only encrypt the HDD which holds the important stuff. Does that make the HDD secure? –  astralbanana Aug 12 '13 at 20:09

There are two answers: No and Yes.

First to the "Yes": If there is really only one known cold boot attack against bitlocker, it's extremely unrealistic that somebody executes it, and if you're not the president of the US, you're not really endangered.

Second: NO! Even of it's unlikely that you're going to be attacked, it could happen! AND: You're using a Microsoft product. In times of PRISM and NSA you shouldn't really trust them.

TIP: Use a free OS like Fedora and glue your RAM to it's banks.

share|improve this answer
I guessed that because it's a Microsoft product, there could be any kinds of backdoors for NSA. Even though I might not have anything seriously illegal on my HDD, it's just a matter of principle. I guess TrueCrypt would be better option. –  astralbanana Aug 11 '13 at 17:45
@astralbanana What makes you believe Truecrypt is better? The Linux kernel itself had backdooring potential with the RdRand code that Linus Torvalds included. –  Luc Aug 11 '13 at 19:55
@Luc I'm more confident trusting it since it's open-source, instead of being developed by a huge company that certainly has connections to agencies that would have a motivation to request backdoors. –  astralbanana Aug 12 '13 at 17:11

If Windows is running, your drive mounted and hence unencrypted, and if your physical interfaces aren't protected against connection at the OS level, yes there are many ways to get your data out.

The biggest deception point is that this access to your BitLocker protected disk will be much easier through the network than through any physical direct access. As long as Windows is on, it is the "royal" entrance path. This weakness stands for any OS, not just Windows.

Just have a look at the number of bug fixed every month in every OS. Some security expert are today comparing OSes in terms of "bug throughput". And the leader is…

BitLocker software will bring you a real security against the theft of your computer if you strictly abide to the following basic rule:

As soon as you have finished working, completly shut off Windows and allow for every shadow of information to disappear (from RAM, disk caches…) within 2 minutes.

share|improve this answer

Elcomsoft Forensic Disk Decryptor promises to :

"offer investigators a fast, easy way to access encrypted information stored in crypto containers created by BitLocker, PGP and TrueCrypt."

What's scary, is that this software can be purchased by anyone.

I believe this confirms that there is NO SECURE MEANS OF ENCRYPTING A DISK.

share|improve this answer
... given certain conditions. Read the section on how it acquires the encryption keys. –  schroeder Jul 7 at 20:39
"In order to obtain the decryption keys, the encrypted volume must be mounted on the target PC." –  daniel Azuelos Jul 7 at 21:08

Bitlocker certainly isn't because they have law enforcement power point presentations saying they can gain access to it and you certainly don't see the Fed pressuring MS anymore like they are other groups encrypting. Stay open source and research.


share|improve this answer
I'll bite. Assume for a minute that the U.S. govt did manage to backdoor the systems called out in that presentation. Knowledge of this would be highly classified and wouldn't be shared with some county sheriff's office in Oregon. Your source is highly suspect. –  Levi Oct 3 at 6:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.