Assuming I boot up a fully encrypted OS from a portable flash drive and do some tasks in this running OS; then abruptly disconnect this flash drive from my computer and a malicious actor gets their hands on it. Is there a chance that they could read the unencrypted portions of the last state of my OS? How hard would it be to observe potential unencrypted data without messing it up?

My setup would be MacOS encrypted using Firevault, but i'm rather more interested in the general broader logic on this question, than on this particular config.

1 Answer 1


First, it is nearly impossible to have a "fully encrypted" boot drive, because the bios typically can't decrypt the bootloader. (We use secure boot to make sure it is a signed binary instead.)

Second, when the OS is using the encrypted disk, it doesn't decrypt it on disk. It loads encrypted data from the drive, decrypts it in memory and uses it, and encrypts data in memory before writing it back to the drive.

So the only way for an attacker to steal decrypted data is to grab it from the decrypted copy in memory somehow, or obtain your encryption key by some method.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .