28

Let's assume I have a Windows 10 computer and my login password has an entropy of infinity.

If I did not encrypt my entire hard-drive, does it matter how secure my password is? Is it possible for someone to plug the hard-drive into another computer as an external drive and simply read all its contents?

Thanks

Improve this question
8
  • 11
    It's absolutely not safe. Even if the hard-disk was formatted it would be possible to recover the deleted files.
    – Adamantios Marios Berzovitis
    Commented Dec 11, 2020 at 23:26
  • 6
    @AdamantiosMariosBerzovitis Please don't answer in comments. Thanks!
    – Asteroids With Wings
    Commented Dec 12, 2020 at 16:59
  • 5
    @AdamantiosMariosBerzovitis That depends; after a full format (overwriting every sector), recovery is impossible in any reasonable practical sense. After a quick format (only rewriting the partition table), sure.
    – marcelm
    Commented Dec 12, 2020 at 17:42
  • 1
    @marcelm: very far from it. Data recovery specialists do it all the time. There are even easily and cheaply available programs that do it for you. If you want to be perfectly sure, you need several passes with appropriately structured data. There are safe erasure programs that do that, but the process is rather slow, of course. The requirements have been decreased in the latest decade or so, older HDD technologies required 5 and 7 and even more passes to be sure, today it seems to be less than that but still, one pass erasure doesn't mean impossibility.
    – Gábor
    Commented Dec 14, 2020 at 12:17
  • 6
    @Gábor Can you provide a credible source for that claim? As far as I know, it's simply not true; see for example Overwriting Hard Drive Data: The Great Wiping Controversy by Wright, Kleiman, and Sundhar. That paper concludes that even using an magnetic force microscope, recovering data from a 1GB drive (so much larger bits than current drives) is not feasible. I sincerely doubt it is possible at all, never mind using "easily and cheaply available programs".
    – marcelm
    Commented Dec 14, 2020 at 15:39

5 Answers 5

Reset to default
63

Is a password-protected stolen laptop safe?

No.

The immutable laws of security say:

Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.

It doesn't matter if your laptop is password-protected or not. As long as the disk is not encrypted by a state-of-the-art encryption algorithm, anyone can access your data.

If I did not encrypt my entire hard-drive, does it matter how secure my password is?

No. Your data are safe if, and only if, the data are well encrypted. Password protection of an OS usually does not encrypt the disk (except on iOS, as far as i know). Consider using BitLocker (on Windows), FileVault (on macOS), or LUKS (on Linux).

Is it possible for someone to plug the hard-drive into another computer as an external drive and simply read all its contents?

Yes, someone will do exactly this.

Improve this answer
16
  • 41
    'Is it possible for someone to plug the hard-drive into another computer as an external drive and simply read all its contents?' - or even simpler, boot the laptop from a live usb iso, and proceed to read the contents of the drive.
    – mti2935
    Commented Dec 12, 2020 at 3:10
  • 7
    @mti2935 That makes some assumptions about the UEFI security - specifically, that the firmware allows booting from removable media, or at least allows changing settings without a password - but on most machines one or both of those are true, and even if they aren't it's usually only a little more complicated to bypass.
    – CBHacking
    Commented Dec 12, 2020 at 9:42
  • 3
    I believe most modern Android implementations also encrypt the contents if you set a passcode.
    – SomeoneSomewhereSupportsMonica
    Commented Dec 12, 2020 at 11:27
  • 20
    "Yes, someone will do exactly this." -- I'm not at all sure a single stolen laptop will have that fate. I would find it far more likely that it would end up forgotten in some storage for lost items (if the finder is honest), or reinstalled and sold as used to some new unsuspecting user (if the finder is dishonest). That still doesn't make the data safe, though.
    – ilkkachu
    Commented Dec 12, 2020 at 20:54
  • 3
    @ilkkachu - I would expect that the most likely reason to snoop is prurience.
    – Richard
    Commented Dec 13, 2020 at 13:58
21

Just to add a very simple answer here, I regularly boot a linux live cd/usb on friends' computers who have done something weird and need to recover files, and simply copy them over to an external harddisk. This is standard procedure, nothing 'hacky' about it.

So no, if someone was left alone with your computer, a windows password is trivial protection against accessing files on the computer. All they'd have to do is carry a linux usb with them and boot from it1; the whole process would take, like, 1 minute.

1. assuming the typical non-technical-user scenario where no further protections (e.g. a bios password) are in place

Improve this answer
4
  • 2
    I've done this to retrieve my roommate's software engineering project from a laptop after the hard drive malfunctioned and some OS files got corrupted. No password was required. (Thankfully for my roommate, the project files were not corrupted.)
    – OpenAI was the last straw
    Commented Dec 14, 2020 at 20:02
  • 2
    I just wanted to add that even some BIOS passwords aren't safe- it turns out there are online code generators that you supply the 'error message', it supplies you BIOS passwords. Guess how I learned that?
    – J.Hirsch
    Commented Dec 14, 2020 at 22:20
  • 1
    @J.Hirsch I wanna know. How?
    – Hashim Aziz
    Commented Dec 14, 2020 at 23:33
  • 1
    Just pick the harddisk, and plug it into another computer by USB. BIOS password does nothing in this situation.
    – recolic
    Commented Dec 15, 2020 at 6:40
12

As anion's answer points out, the data on your hard disk is generally not safe under the system you described. However, Windows does offer several encryption methods beyond just BitLocker, and they might be helping you out already.

  • Encrypting File System (EFS) is a way to transparently encrypt file contents (though not the metadata, like file names or sizes) such that they can only be decrypted by authorized Windows users. Assuming the files hadn't been shared with any other users on the same machine (or domain) whose passwords were crackable, the contents of those files would be safe. However, EFS is only available on the higher Windows editions (Pro, Enterprise, Server, etc.). Additionally, it is rarely used unless the user manually enables it (software can enable it but very rarely does so).
  • Data Protection API (DPAPI) is a way to encrypt arbitrary blobs of data (which can then be written to a file, registry key, database, etc.) so that they can only be decrypted by either the user who encrypted them, or by any user on the machine that encrypted them (typically, the user-specific form is used). DPAPI is available on all editions of Windows, and - possibly for that reason - is reasonably commonly used by software that wants to store sensitive data. For example, Chrome encrypts your site data (cookies, passwords, etc.) using DPAPI. Windows itself also uses DPAPI for some data, including the built-in password storage (used in Edge and IE) and to protect private keys in the certificate manager (even if you don't explicitly put passwords on those keys).

Both DPAPI and EFS use encryption keys protected by the user's password. This means that an attacker can't learn those encryption keys without breaking the password. Normally breaking Windows passwords is relatively easy - the hashing function used is decades out of date and not even used in a very secure way - but a sufficiently long and random password is still de facto uncrackable. Similarly, the encryption algorithms used with DPAPI and EFS aren't the latest, but they're secure enough that it would be very surprising if even the NSA could break them (either by cryptanalysis or by brute-forcing the key).

Note that it's quite easy, if you have access to a computer's unencrypted hard drive, to overwrite any user's password. However, if you do this, it becomes impossible to ever recover either the DPAPI or EFS keys, so any data protected using either feature is lost forever (unless the keys and/or data were backed up elsewhere).

So... you're still in major trouble. All your unencrypted files (pictures, documents, any local emails or chat logs or whatever) will be exposed. However, the attacker will probably not be able to see passwords that Windows or Chrome (or some other browsers) were storing for you, or use your saved browser cookies, so you're more likely to be safe against an attacker compromising your online accounts. Some especially security-conscious desktop software might also have protected its files, especially if your Windows edition supported EFS.

Improve this answer
2

Is it possible for someone to plug the hard-drive into another computer as an external drive and simply read all its contents?

Yes.

It is irrelevant what operating system (or lack of) was installed on that drive. It is irrelevant what passwords (or lack of) were used. It is even irrelevant whether the drive is encrypted – although that may determine whether its contents are of any use to anyone else (see clarification below).

This question is full of distractions, which might be why you couldn’t answer it yourself, even though the answer should be blindingly obvious.

Clarification about encryption: Encryption simply means replacing the data you want to keep safe (the “plaintext”) with a different set of data (the “ciphertext”), where a person looking at the ciphertext cannot easily tell what the plaintext is.

It looks like the term “contents” is ambiguous here: it could refer to the plaintext or the ciphertext. But from your wording (“If I did not encrypt my entire hard-drive”), I assume you are referring to encryption implemented in software running on the CPU, not the drive itself. In this case, if the drive is encrypted, then the drive never sees the plaintext, so I would say that the drive’s contents are ciphertext.

With this interpretation, it is correct to say that encryption is irrelevant to how easily the drive’s contents can be read. It may be relevant to how easily the plaintext can be recovered (depending on whether you did the encryption right).

Improve this answer
4
  • 1
    "It is even irrelevant whether the drive is encrypted" -- irrelevant to read the drive's contents? Can you explain that comment?
    – schroeder ♦
    Commented Dec 13, 2020 at 20:10
  • @schroeder I have added an explanation to my answer.
    – Brian Drake
    Commented Dec 14, 2020 at 0:23
  • 1
    You can read the contents of the drive without problem. If the contents is encrypted, then it isn't useful to an attacker.
    – gnasher729
    Commented Dec 14, 2020 at 16:54
  • @gnasher729 It might be useful as a source of white noise. On a more serious note, it might also be useful if it was poorly encrypted. That's why I said "depending on whether you did the encryption right".
    – Brian Drake
    Commented Dec 15, 2020 at 13:59
0

The other Answers already cover it. But there is an even easier way to get into your Laptop if I stole it. Just boot up KonBoot and it will bypass all authentication mechanisms and I can set a new password for the user of my choice to whatever I want and then use your Laptop the normal way.

Improve this answer
3
  • 1
    Will this also give you access to encrypted content like passwords and cookies stored in browsers? (These are considered safe in OPs scenario as they are encrypted by the user login according to comments on the top answer.)
    – dreua
    Commented Dec 14, 2020 at 17:38
  • Are you referring to this not-very-convincing comment by Dan M.: "IRC, some stuff will still be encrypted (like browser passwords)"? As far as I know, only Internet Explorer/Edge uses the secure storage provided by Windows. I'm sure that Firefox doesn't, since I've read about it using its own files and it has its own "master/primary password". I think I read that Chrome doesn't either. Even the Microsoft browsers don't encrypt cookies, do they?
    – Brian Drake
    Commented Dec 15, 2020 at 13:57
  • Chrome does indeed use the Windows function "CryptProtectData", which uses your windows password (superuser.com/questions/146742/…). And it also encrypts cookies (but stores the encryption key in the localState file - sans user password I think, stackoverflow.com/questions/60416350/…).
    – CShark
    Commented Dec 16, 2020 at 8:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .