Timeline for At what point is a Bitlocker drive unlocked and how does additional pre boot pin add to security?
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 30, 2016 at 14:40 | comment | added | GnP | @user1102550 yes, FDE with any pre-boot auth (pin, passphrase, USB key) will protect your data in case the laptop is stolen, provided it's shutdown/hibernated when it's stolen. FDE with no pre-boot auth won't, but makes remote wiping easier and safer and enterprises appreciate that. | |
| Aug 30, 2016 at 14:04 | comment | added | user1102550 | In the scenario of data which is not super sensitive - I am protecting against the laptop getting stolen by a regular thief as opposed to the NSA or professional hacker is it reasonable to assume that the only way of accessing the hard-drive is via a cold boot attack or something fairly sophisticated? I.e to get the data you'd have to remove the hard drive and it wouldn't mount without the TPM? | |
| Aug 30, 2016 at 14:01 | comment | added | GnP | @user1102550 yes, FDE protects against offline data theft. Once it's mounted it's not offline anymore and is beyond the scope of FDE. That's why you should always start with a threat model and then evaluate technologies. The other way around is painful, inefficient and often surprising. | |
| Aug 30, 2016 at 13:56 | comment | added | user1102550 | So what's the point of encrypting the harddrive if it's mounted at when the machine boots. Is it just in case the hard drive is removed? | |
| Aug 30, 2016 at 11:09 | comment | added | GnP | @user1102550 with pre-boot pin/password/key it's not. The login screen/lockscreen is separate and if you see that screen the volume is unlocked (assuming FDE) | |
| Aug 30, 2016 at 7:06 | comment | added | user1102550 | But when the computer first boots, the disk isn't mounted until the password is entered? | |
| Aug 29, 2016 at 21:11 | comment | added | GnP | @user1102550 Yes it is. The lockscreen does not lock the encrypted volume. | |
| Aug 29, 2016 at 20:48 | comment | added | user1102550 | Just to double check if the OS has a regular Windows password but has a TPM. The disk isn't mounted until the password is sucessfully entered. | |
| Aug 29, 2016 at 19:48 | history | answered | GnP | CC BY-SA 3.0 |