Why I believe this question is not a duplicate: There are multiple questions dealing with the exploitation of a locked computer on this site, but most of the answers are focused on exploiting a non-hardened system in default configuration. I believe that in recent years, with major advances in encryption and hardware+software authentication (secure boot, bitlocker, virtualization, UEFI,...), the threat model for a hardened laptop is significantly different and therefore, I'm reasking this question under the following scenario:
- I'm using a modern Windows 10 Pro laptop, with the OS and all drivers updated to latest versions.
- Laptop is locked, with following authentication methods: fingerprint reader, strong password, reasonably strong PIN (probably would not survive an offline brute-force).
- Internal drive is encrypted with PIN-less Bitlocker, using TPM.
- UEFI is password-protected, booting from external drive requires UEFI password, network boot is disabled, Secure Boot is on.
- I'm connected to the same network as an attacker (attacker may potentially even own the network).
- The laptop has an enabled Thunderbolt 3 port, but before any conected device is accepted, it must be authorized by the user (which should not be possible on the lock screen).
- Laptop has a free M.2 slot inside, dis/re-assembly is possible in under a minute.
Assuming I'm sitting somewhere with an attacker, I lock my laptop and leave for 5 minutes, is it feasible for the attacker to gain access to my laptop (either by bypassing the lock screen, or extracting files using some other method (extracting the bitlocker key,...)) before I return, under the condition that I mustn't notice anything suspicious after coming back?