In other words, how easy is it to break into Windows without having the passwords for any of the users configured in the computer?
closed as too broad by Adi, Xander, schroeder♦, TildalWave, Eric G May 31 '14 at 3:57
There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.
The answer to your question is that it depends on a number of factors.
So ultimately it depends. In the general case an unsophisticated attacker getting access to a full-disk encrypted drive protected with a strong password that he doesn't have, probably won't be able to compromise it, but there's a lot of variables at play.
Edit : per the comments below the list above isn't exhaustive, but hopefully provides an idea of some of the potential variables at pley.
Yes. With a cold boot attack.
Depending on the software used to encrypt your data and when the attacker gets a hold of your laptop, there is a good chance that they can get access to whatever they want, if they know how.
The problem lies in the fact that many disk-encryption tools, including BitLocker, store the keys in RAM. The trick to the attack is to cool the RAM down.
This attack relies on the fact that the RAM in your laptop will retain its information, even after power loss, for a certain amount of time. If you cool the RAM down, it will retain its information, without power, for longer. The researchers did this by spraying compressed air or liquid nitrogen onto the RAM modules while the laptop was running. Then they removed the modules and loaded them into their own specialised system.
From there, they could inspect the contents of the memory and look for important information like DES, AES, or RSA keys. Using algorithms to scan the loaded memory, you can detect crypto keys.
[ 1 ] J. Halderman et al. "Lest we remember: cold boot attacks on encryption keys" (site contains a link to the research paper).
If your computer ONLY has password for user accounts then extremely easily. You could just load ANY LiveCD and it will ignore the file permissions thus giving the attacker full file rights.
If you have encryption then question is too broad scope we need to know what software you used for encryption and so on. I can expand on my answer if you provide encryption software you used.
You have several different questions here:
Assuming we're still talking about a machine whose hard drive is encrypted with the built in BitLocker, then as far us we know: it's not easy.
But those aren't really the central issue.
The big issue is whether or not the professional hacker in question believes that the data on the drive is worth the amount of time and money necessary to crack it. If we're talking the NSA and you have data related to a high priority national security issue which presumably can't be accessed in any other way (e.g. the person who knows the password is "unavailable"), then they will throw the computing power necessary at cracking it.
However if we're talking about a laptop that was stolen by someone completely unaware of the contents then they'll likely just reformat the thing and ebay it. Heck, they may just pawn/ebay it as is.
In other words, the central question boils down to whether you were just a target of opportunity (petty theft) or were a target of professional surveillance. If the latter then you can bet that they only took the laptop when they felt they had enough information to easily access the drive contents - in other words they managed to get your passwords. It's usually easier (ie: cheaper/faster) to utilize modern surveillance techniques to eaves drop on a password being typed than it is to crack solid encryption. Devices to listen in on keystrokes or even pin hole cameras in a ceiling are certain one option...
A third option is if the laptop was picked up by your local police when they were arresting you. For this it's probably far easier to force you to divulge the passwords (based on various countries laws) than it is to bother trying to crack the laptop. Some countries have fairly lopsided laws in which it would still be in your best interest to give up the password to incriminating evidence than to stay silent.
Hopefully the hard disk is encrypted using BitLocker, which means by default makes your hard disk would be the first device your laptop would boot on. If the hacker tries to change the boot order (reset local admin password using Linux tool), then the BitLocker will be locked (needs to enter 48-characters recovery key to unlock). If the user manages to dismantle the hard disk, the hard disk would be treated as BitLocker ToGo, so the same locking policy applies.
Now it is time to make explicit one fundamental property of the field of Information Security, which pertains to the debate at hand:
This is not a game. There are no rules.
Let's see what this means by first reviewing the "technical answer" (that has been expanded upon by other answers to this question). The "professional hacker" will be kept at bay if all of the following are true:
The point about the laptop being shut down is for cold boot attacks. After a few minutes of being shut down, the RAM contents are definitively lost -- whereas "sleeping" and "hibernation" are techniques to keep the RAM contents alive somewhere (either by using the battery to keep the RAM powered, or by storing its contents on the hard drive).
However, the important point is the last one. All of these technical considerations are indicative of anything only as long as the thief is obliging enough to accept to operate within the stated context, the "rules of engagement". Namely, the thief has temporary physical access to the laptop, and just grabs it. He does not try to, say, insert some key logging apparatus or other backdooring system to the laptop, then leave it in place, so that the user, unsuspecting of the hacker's intervention, guilelessly types in his password again, unlocking all his deepest secrets.
This is where the scenario is unrealistic. We are talking about a professional hacker. By definition, that hacker makes a living out of his activities. He is interested in your information, and will not feel compelled to act only within the constraints of an ideal story. Most successful "hacking" stories often include, as pivotal element, a non-technical action, usually so-called social engineering (where the "engineering" term belies the fact that, indeed, this is not about engineering but psychology and sociology), or simple downright burglary. To (ab)use Chamberlain's quote: the professional hacker is not a gentleman.
Now if we were talking about an amateur hacker, then things change quite a lot. The situation becomes the following:
In that case, we have actual facts which have happened in the physical world, thus a firm foundation for the context in which the question takes place. The laptop was stolen, not silently modified. Whoever did the deed was not, at the time of theft, a professional hacker targeting the data; rather, it was an opportunistic bystander who thought he could make a few bucks out of the laptop itself. If so, properly implemented and applied whole-disk encryption, protected with a strong password on a laptop which was completely off, will save the day, in that it will limit the cost to the loss and lack of availability of the hardware.
It depends on the encoding software. If it used BitLocker, it is possible to crack only the BitLocker password, which is not hopeless with a dictionary attack. To crack the Bitlocker key is normally hopeless.