Naturally I feel that I have to ask this question, since it's a built-in feature in Windows. Let's say someone has physical access to my PC, is there an easy way for them to access a BitLocker protected drive without physically tampering with the PC (such as hardware keyloggers)?
There is currently only one cold boot attack I know of that works against bitlocker. However it would need to be executed seconds after the computer has been turned off (it can be extended to minutes if the DRAM modules are cooled down significantly) but due to the timeframe of execution it's rather implausible. Bitlocker is secure as long as your machine is completely turned off when you store it (hibernate is also ok, but sleep needs to be disabled).
There is also the "Evil Maid" attack that could, in theory be used against any software disk encryption, as the boot loader needs to still be unencrypted. See Bruce Schneier's article about it from 2009. http://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html
The general gist of the "Evil Maid" attack is that someone gets ahold of your laptop for a few minutes when it is unattended (for example, in your hotel room, hence the name) and loads a hacked bootloader into it. You then log in with your password via the hacked boot loader and it unlocks the drive, but also writes your password to a .txt file in the unencrypted part of the HDD. You leave your laptop alone again, they steal it with the password.
In general, Bitlocker is secure and is used by companies all over the world. You can't just extract keys out of the TPM hardware. Evil maid attacks are mitigated also since TPM will validate the pre-boot components to make sure that nothing has been tampered with. Booting into another OS like Linux to extract passwords or the data will not be possible also, since the TPM will not release its keys if it sees you're booting into another OS (even if it is another Windows OS).
If you pass the TPM's integrity check, then the keys will be released to be used for on-the-fly encryption and decryption. Failing which, you get a Bitlocker recovery key lockout, and must supply the recovery key in order to unlock the drive. The attacker should not be in possession of this key. Therefore, never put both the recovery key and your computer together.
Some answers alluded to various forensic tools. However, I am personally not convinced that they work on all systems. For example in TrueCrypt, the key is actually derived from the password which the user keys in. You cannot feasibly brute force AES. As for Bitlocker, the TPM is a hardware solution that stores the key. You can't extract the key with software.
If Windows is running, your drive mounted and hence unencrypted, and if your physical interfaces aren't protected against connection at the OS level, yes there are many ways to get your data out.
The biggest deception point is that this access to your BitLocker protected disk will be much easier through the network than through any physical direct access. As long as Windows is on, it is the "royal" entrance path. This weakness stands for any OS, not just Windows.
Just have a look at the number of bug fixed every month in every OS. Some security expert are today comparing OSes in terms of "bug throughput". And the leader is…
BitLocker software will bring you a real security against the theft of your computer if you strictly abide to the following basic rule:
As soon as you have finished working, completly shut off Windows and allow for every shadow of information to disappear (from RAM, disk caches…) within 2 minutes.
Bitlocker certainly isn't because they have law enforcement power point presentations saying they can gain access to it and you certainly don't see the Fed pressuring MS anymore like they are other groups encrypting. Stay open source and research.
It depends what you want to be secure from. Unauthorised copying is what bitlocker is built for and it stops it. Denial of access so nobody can access the data. Not so much. In fact it seems to me to be bit open to that.
If someone has physical access to your PC, it depends on what YOU will do next:
you won't access it ever again (PC stolen, seized, whatever), then unless they are a governmental entity, they cannot access your data, now. If they keep the disk for a few years, chances are some flaw/bug/vulnerability will have been uncovered by then and they will be able to access your data with ready-made tools and no expertise needed. But maybe there are no bugs and no flaw...
if you will use the PC again, then I hope you had a strong BIOS password, and confidence in that BIOS, because otherwise they could just flash your BIOS with a keylogging one.
you're just off for coffee, just a minute... then they could just wipe your keyboard real clean, wait until your enter your password again, and then distract you while they take a snap of your keys. The dirty keys will be those of your password, even if you entered a few extra keystrokes, this info greatly diminishes the complexity of brute-forcing your password. Also works with UV glowing powder, cheap "invisible" ink, etc.
So basically Bitlocker will stop a casual thief from accessing the drive of your stolen Laptop, but it won't do squat against a determined adversary that has physical access to your machine while you are away.
And note the last two apply to all encryptions that only involve only a password, as well as greatly diminishes the security of smartcard/PIN-only systems if they can steal the smartcard.
There are two answers: No and Yes.
First to the "Yes": If there is really only one known cold boot attack against bitlocker, it's extremely unrealistic that somebody executes it, and if you're not the president of the US, you're not really endangered.
Second: NO! Even of it's unlikely that you're going to be attacked, it could happen! AND: You're using a Microsoft product. In times of PRISM and NSA you shouldn't really trust them.
TIP: Use a free OS like Fedora and glue your RAM to it's banks.
I haven't seen this mentioned in the previous answers.
In certain cases BitLocker won't encrypt your drive and let the drive encrypt itself using hardware encryption. This is not always done well.
At least according to this link: https://www.howtogeek.com/fyi/you-cant-trust-bitlocker-to-encrypt-your-ssd-on-windows-10/
Elcomsoft Forensic Disk Decryptor promises to :
"offer investigators a fast, easy way to access encrypted information stored in crypto containers created by BitLocker, PGP and TrueCrypt."
What's scary, is that this software can be purchased by anyone.
I believe this confirms that there is NO SECURE MEANS OF ENCRYPTING A DISK.
Currently the only secure way to protect the data on the disk is to use full disk encryption with pre-boot authentication based on credentials stored on a smart card. This protects as well against any DMA attacks via the physical interfaces.
protected by Community♦ Sep 8 '17 at 19:18
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?