I have a Windows system and I protected the drive with BitLocker encryption.
Can BitLocker encryption be bypassed by live-booting with Linux or any other OS?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
First off, you should go type "how bitlocker works" into google and read a few articles. You will probably learn the answer to your question (and a bunch more interesting things besides!).
If you want a quick answer, I found an article by Microsoft that says:
During the startup process, the TPM releases the key that unlocks the encrypted partition only after comparing a hash of important operating system configuration values with a snapshot taken earlier. This verifies the integrity of the Windows startup process. The key is not released if the TPM detects that your Windows installation has been tampered with.
There are two important points here:
The keys to decrypt your hard drive are stored in the TPM chip on your motherboard, so you would need to live-boot on the same motherboard, and your live-boot OS would need to convince the TPM to release the keys.
It's not 100% clear from the above but it seems like the TPM checks RAM during startup to make sure that the OS being booting is the same one that registered the encryption keys in the first place.
So it would probably be hard to "fool" the TPM into releasing the keys to your live-boot Linux.
That said, Wikipedia has details on a successful attack: https://en.wikipedia.org/wiki/BitLocker#Security_Concerns
In February 2008, a group of security researchers published details of a so-called "cold boot attack" that allows full disk encryption systems such as BitLocker to be compromised by booting the machine off removable media, such as a USB drive, into another operating system, then dumping the contents of pre-boot memory.
So it seems that it's not as simple as just booting into Linux and reading the drive, but if an expert hacker has access to your computer while its running and logged into the decrypted drive, then it's possible to reboot into linux quickly enough that RAM still has the old data on it pluck the decryption key directly out of memory, this bypassing the TPM entirely. For more info on this attack, see: wikipedia/Cold_boot_attack.
As @AndréBorie points out in comments, if you're willing to do some electrical engineering and sniff the connection between the TPM and the rest of the motherboard, then you can boot the system normally and read the decryption key off the wire.
I guess the old adage proves right once again; Ten Immutable Laws Of Security:
Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.