If someone unplugs the hard-drive of my laptop while it's running, what contents would they be able to extract from it?

I understand that on login, the image of my hard-drive is mounted, but I'm not exactly sure what effect extracting the hard-drive would have on this "mounting".

  • 2
    What kind of disk encryption are you using? There are different types that all work very differently.
    – Grant
    Dec 26, 2014 at 3:35

3 Answers 3


If your question is, does mounting an encrypted drive decrypt the entire drive, the answer is no. Mounting an encrypted drive unlocks the encryption key which is itself encrypted by the mount passphrase. It then passes the key to the driver so that blocks of the disk can be decrypted when read and encrypted when written. So, what is decrypted is in memory, not on the disk, and only for files in active use at the moment.

The vulnerability is a weak passphrase. If someone can seize an encrypted drive and guess or otherwise obtain the passphrase that unlocks the crypto key, then the entire drive can be decrypted just by mounting the drive and copying the files to an un-encrypted drive.

This vulnerability is why Ramona Fricosu is in jail. (Her husband ratted her out by supplying a list of possible passwords.)


On disk encryption has some rather interesting effects on the vector of attacks. In particular, what it means is, instead of passive retrieval, the attacker must have a plant on your machine. In the event you do not have physical control, the attacker has to try every combination of keys to brute force a mount. Hopefully this will take a long enough time for you to invalidate anything. That part is purely up to your process.

The rather long long take on things is: if you double encrypt everything, you'll be doubly secure. Though why anyone would want to do this is beyond me.


well if the data is encrypted then can pull nearly anything from the machine regardless of the encryption...yes it would be unreadable and may be damaged if "torn out while mounted" but all it takes is someone with a specific data decompiler or the encryption keys and the data can be used... and everything on that hard drive such as passwords, event logs, software information can be used and can even recover deleted files unless badly overwritten but yes different encryptions work differently but if decrypted by software can be used. as long as the hard drive is still functional.

personal experience: 5 years research in IT security,Hardware divisions

  • "specific data decompiler" hum... what ? Is there some magic "data decompiler" that can circumvent encryption that I'm not aware of ?
    – user42178
    Dec 26, 2014 at 7:13
  • If there is, the NSA will pay all the money there is for a copy!
    – Bob Brown
    Dec 26, 2014 at 13:06
  • While it's true that having the password will allow you to decrypt the file, that's quite obvious. I think it's reasonable to assume Seanny understands this most basic of encryption knowledge. I'm also unfamiliar with what a "specific data decompiler" is. Dec 26, 2014 at 16:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .