In other words, how easy is it to break into Windows without having the passwords for any of the users configured in the computer?

closed as too broad by Adi, Xander, schroeder, TildalWave, Eric G May 31 '14 at 3:57

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Wouldn't that be just a question on how strong the passwords are? – ndrix May 28 '14 at 11:35
  • 10
    How is the hard-drive encrypted? – Philipp May 28 '14 at 13:48
  • 15
    The title of the question, and "in other words" are two separate questions. – OrangeDog May 28 '14 at 14:14
  • 1
    ... and by any number of amateur hackers too! – Carl Witthoft May 28 '14 at 19:59
  • 12
    Obligatory XKCD link xkcd.com/538 – Andrea May 29 '14 at 9:42

The answer to your question is that it depends on a number of factors.

  • What disk encryption product is in use? Does it make use of full disk encryption, or does it just encrypt parts of the disk (e.g. the users home directory)
  • Are there any known vulnerabilities in the disk encryption product in use?
  • What strength of password was used by the user of the stolen machine?
  • Did the user do anything very daft, like having the password on a bit of paper in their bag.
  • Does the disk encryption product allow for effectively offline attacks, or can it enforce a lockout policy such that only a limited number of guesses are allowed before the data is destroyed?
  • How determined and well funded are the attackers? In the case of government level attackers they may have a means of bypassing/backdooring the software.

So ultimately it depends. In the general case an unsophisticated attacker getting access to a full-disk encrypted drive protected with a strong password that he doesn't have, probably won't be able to compromise it, but there's a lot of variables at play.

Edit : per the comments below the list above isn't exhaustive, but hopefully provides an idea of some of the potential variables at play.

  • 1
    Cold boot? Evil maid? TPM weaknesses? – paj28 May 29 '14 at 9:01
  • 3
    @paj28 don't forget Rubberhose Crytoanalysis – Aron May 29 '14 at 9:06
  • 1
    ... Is the encryption software backdoored? (How many eyes have access to the source code?) Has it ever been audited? – ignis May 29 '14 at 11:34
  • 1
    How would you enforce a limit on the number of guesses at the password? An attacker would just read the encrypted data directly with software tweaked for the purpose. If there was any way to prevent bypassing the encryption solution like that, then it wouldn't need to encrypt the data in the first place. – kasperd May 29 '14 at 20:00
  • 2
    @kasperd: it's a lot easier for hardware to provide a reasonable level of protection for a small amount of data (i.e., an encryption key) than for a large amount (i.e., the contents of your hard disk). No tamper-proofing is perfect, but I'm sure it can be made quite difficult to extract an encryption key stored in a tamper-proof chip. – Harry Johnston May 30 '14 at 5:14

Yes. With a cold boot attack.

Depending on the software used to encrypt your data and when the attacker gets a hold of your laptop, there is a good chance that they can get access to whatever they want, if they know how.

The problem lies in the fact that many disk-encryption tools, including BitLocker, store the keys in RAM. The trick to the attack is to cool the RAM down.

This attack relies on the fact that the RAM in your laptop will retain its information, even after power loss, for a certain amount of time. If you cool the RAM down, it will retain its information, without power, for longer. The researchers did this by spraying compressed air or liquid nitrogen onto the RAM modules while the laptop was running. Then they removed the modules and loaded them into their own specialised system.

Cooling down memory

On all of our sample DRAMs, the decay rates were low enough that an attacker who cut power for 60 seconds would recover 99.9% of bits correctly... This suggests that, even in modern memory modules, data may be recoverable for hours or days with sufficient cooling.

From there, they could inspect the contents of the memory and look for important information like DES, AES, or RSA keys. Using algorithms to scan the loaded memory, you can detect crypto keys.

We have developed fully automatic techniques for locating symmetric encryption keys in memory images, even in the presence of bit errors.

Our experiments (see Section 3) show that it is possible to recover memory contents with few bit errors even after cutting power to the system for a brief time.


[ 1 ] J. Halderman et al. "Lest we remember: cold boot attacks on encryption keys" (site contains a link to the research paper).

  • See also, e.g., breaknenter.org/projects/inception – Harry Johnston May 29 '14 at 4:47
  • 1
    I'm pretty sure the spray used is called "coolant spray" - you get it in this kind of cans, it's a liquid that quickly evaporates, cooling down to -42 degrees C – Volker Siegel May 29 '14 at 11:08
  • suggesting that shutting the machine right down when it's going to be out of your control is a good idea - that way the RAM stays at roomtemp without being refreshed and wipes itself pretty quickly. Hibernate has its own weaknesses (like keys in RAM written to disk) – Chris H May 29 '14 at 13:35
  • @ChrisH Yep, one of the suggestions from the paper was to encrypt the keys in the disk controller itself. This would require changes to architecture though. – Anthony May 29 '14 at 14:20
  • I read the paper a while back, so forgot that -- anyway I tend to think of user actions, and easy ones at that, rather than system design – Chris H May 29 '14 at 15:20

If your computer ONLY has password for user accounts then extremely easily. You could just load ANY LiveCD and it will ignore the file permissions thus giving the attacker full file rights.

If you have encryption then question is too broad scope we need to know what software you used for encryption and so on. I can expand on my answer if you provide encryption software you used.

  • 12
    The question title does say "an encrypted hard disk". – Andrew Medico May 28 '14 at 19:25
  • 3
    Yes, the title does but the question doesn't so it's unclear if it's encrypted or not but I have asked the thread owner to elaborate on the encryption used if any in this answer. Thanks for your input I did notice this prior to the comment. – Paul May 28 '14 at 22:41

You have several different questions here:

If a Windows laptop with an encrypted hard disk is stolen, can the contents be accessed by a professional hacker?


In other words, how easy is it to break into Windows without having the passwords for any of the users configured in the computer?

Assuming we're still talking about a machine whose hard drive is encrypted with the built in BitLocker, then as far us we know: it's not easy.


But those aren't really the central issue.

The big issue is whether or not the professional hacker in question believes that the data on the drive is worth the amount of time and money necessary to crack it. If we're talking the NSA and you have data related to a high priority national security issue which presumably can't be accessed in any other way (e.g. the person who knows the password is "unavailable"), then they will throw the computing power necessary at cracking it.

However if we're talking about a laptop that was stolen by someone completely unaware of the contents then they'll likely just reformat the thing and ebay it. Heck, they may just pawn/ebay it as is.

In other words, the central question boils down to whether you were just a target of opportunity (petty theft) or were a target of professional surveillance. If the latter then you can bet that they only took the laptop when they felt they had enough information to easily access the drive contents - in other words they managed to get your passwords. It's usually easier (ie: cheaper/faster) to utilize modern surveillance techniques to eaves drop on a password being typed than it is to crack solid encryption. Devices to listen in on keystrokes or even pin hole cameras in a ceiling are certain one option...

A third option is if the laptop was picked up by your local police when they were arresting you. For this it's probably far easier to force you to divulge the passwords (based on various countries laws) than it is to bother trying to crack the laptop. Some countries have fairly lopsided laws in which it would still be in your best interest to give up the password to incriminating evidence than to stay silent.


Hopefully the hard disk is encrypted using BitLocker, which means by default makes your hard disk would be the first device your laptop would boot on. If the hacker tries to change the boot order (reset local admin password using Linux tool), then the BitLocker will be locked (needs to enter 48-characters recovery key to unlock). If the user manages to dismantle the hard disk, the hard disk would be treated as BitLocker ToGo, so the same locking policy applies.

  • unless you take out the disk and mount it on another comp to inspect it – ratchet freak May 28 '14 at 18:31

Now it is time to make explicit one fundamental property of the field of Information Security, which pertains to the debate at hand:

This is not a game. There are no rules.

Let's see what this means by first reviewing the "technical answer" (that has been expanded upon by other answers to this question). The "professional hacker" will be kept at bay if all of the following are true:

  • The whole-disk encryption system is worth that name.
  • When you say whole, you mean whole. Virtual memory space (aka "swap partitions" or "swap files") must also be encrypted.
  • The unlocking password is strong (high entropy).
  • When the laptop was stolen, it was unpowered and properly shut down (not put to sleep or hibernating, but really shut down).
  • The thief runs with the laptop but does not come back.

The point about the laptop being shut down is for cold boot attacks. After a few minutes of being shut down, the RAM contents are definitively lost -- whereas "sleeping" and "hibernation" are techniques to keep the RAM contents alive somewhere (either by using the battery to keep the RAM powered, or by storing its contents on the hard drive).

However, the important point is the last one. All of these technical considerations are indicative of anything only as long as the thief is obliging enough to accept to operate within the stated context, the "rules of engagement". Namely, the thief has temporary physical access to the laptop, and just grabs it. He does not try to, say, insert some key logging apparatus or other backdooring system to the laptop, then leave it in place, so that the user, unsuspecting of the hacker's intervention, guilelessly types in his password again, unlocking all his deepest secrets.

This is where the scenario is unrealistic. We are talking about a professional hacker. By definition, that hacker makes a living out of his activities. He is interested in your information, and will not feel compelled to act only within the constraints of an ideal story. Most successful "hacking" stories often include, as pivotal element, a non-technical action, usually so-called social engineering (where the "engineering" term belies the fact that, indeed, this is not about engineering but psychology and sociology), or simple downright burglary. To (ab)use Chamberlain's quote: the professional hacker is not a gentleman.

Now if we were talking about an amateur hacker, then things change quite a lot. The situation becomes the following:

My laptop has been stolen. I was using whole-disk encryption. Will the thief (who was after the hardware, not the information) be able to also recover may Gmail password and steal my accounts?

In that case, we have actual facts which have happened in the physical world, thus a firm foundation for the context in which the question takes place. The laptop was stolen, not silently modified. Whoever did the deed was not, at the time of theft, a professional hacker targeting the data; rather, it was an opportunistic bystander who thought he could make a few bucks out of the laptop itself. If so, properly implemented and applied whole-disk encryption, protected with a strong password on a laptop which was completely off, will save the day, in that it will limit the cost to the loss and lack of availability of the hardware.

  • 1
    If the hibernation file is encrypted too (which I believe was one of your premises since I would consider the hibernation file similar to a swap file), wouldn't hibernation be just as secure as powered off? – TTT May 30 '14 at 15:49

It depends on the encoding software. If it used BitLocker, it is possible to crack only the BitLocker password, which is not hopeless with a dictionary attack. To crack the Bitlocker key is normally hopeless.

  • Obligatory "that's what they WANT you to think" – Carl Witthoft May 28 '14 at 20:01
  • 1
    i've seen too many people doing impossible things to think there is something really impossible, especially when you have time and money. – Lesto May 28 '14 at 20:28
  • 1
    @lesto Time and money are powerful, but they can't argue with mathematics. If you chose a good, non-dictionary-attackable 48-character password, then nothing short of the attention of a national government is going to get that data off of there in any reasonable time-frame. – Schilcote May 29 '14 at 2:04
  • @Schilcote yu can't argue with math.. when it is implementenet right. AES is actually impenetrable.. but SSL was. And just today there is a lot of concern about TrueCrypt, witch is the standard de facto to crypt partitions.. see on the official page: "truecrypt.sourceforge.net" WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues. Morpheus: "Some rules can be bent, others can be broken." – Lesto May 29 '14 at 11:58
  • 2
    @Schilcote: ultimately this comes down to the difference between, "there is no effective attack on X in the public literature" and "it is impossible to attack X". AFAIK there is no mathematical proof that BitLocker's algorithms are intractable, so it's not mathematics they're arguing with. There may be a better-than-brute force attack, it just hasn't been published (and for that matter plausibly hasn't been found). If anybody knows an unpublished attack it's probably but not necessarily a national government. And as lesto points out, that's even assuming everything is implemented correctly. – Steve Jessop May 30 '14 at 8:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.