BitLocker Encrypted Hard drive without UEFI/BIOS Password set?

Question

My laptop is encrypted with BitLocker with TPM-Only protection and Secure Boot is enabled. Since I do not have any UEFI password set to prevent changes to the UEFI firmware settings, will an attacker still be able to read and access the encrypted hard drive? My recovery key is stored in a secure place away from the laptop. I am the only user using the laptop.

I just need to prevent my data from being read and accessed.

So my question is, even without setting a UEFI/BIOS password, can the encrypted data be read on the hard drive?

Of course, an attacker can just change the UEFI/BIOS settings, disable Secure Boot, and boot from a malicious program. But, will the attacker still be able to read the contents of the encrypted hard drive?

Thanks!

Answer 1

The information you provide is not really sufficient for an exact determination.

An encrypted HDD should be generally secure, but the Bitlocker itself is not. Its encryption proved to not even actually work in some scenarios.

Depending on the correct implementation, the hardware it is used on and vulnerabilities like CVE-2018-12037, CVE-2018-12038, using bitlocker can be safe or NOT.

Regarding the UEFI password relation, Bitlocker blocks operating systems from accessing certain volumes and needs password decryption but it existed before UEFI and its information is typically stored on a Windows System or Recovery partition, therefore independent, while secure boot blocks untrusted operating systems from booting.

As a conclusion, setting or not an UEFI password does not influence how functional (or not functional) Bitlocker is.

If Bitlocker initially worked correctly and the encryption was actually done, no, attackers cannot access it.