If a Windows laptop with an encrypted hard disk is stolen, can the contents be accessed by a professional hacker?

Question

In other words, how easy is it to break into Windows without having the passwords for any of the users configured in the computer?

Answer 1

The answer to your question is that it depends on a number of factors.

• What disk encryption product is in use? Does it make use of full disk encryption, or does it just encrypt parts of the disk (e.g. the users home directory)
• Are there any known vulnerabilities in the disk encryption product in use?
• What strength of password was used by the user of the stolen machine?
• Did the user do anything very daft, like having the password on a bit of paper in their bag.
• Does the disk encryption product allow for effectively offline attacks, or can it enforce a lockout policy such that only a limited number of guesses are allowed before the data is destroyed?
• How determined and well funded are the attackers? In the case of government level attackers they may have a means of bypassing/backdooring the software.

So ultimately it depends. In the general case an unsophisticated attacker getting access to a full-disk encrypted drive protected with a strong password that he doesn't have, probably won't be able to compromise it, but there's a lot of variables at play.

Edit : per the comments below the list above isn't exhaustive, but hopefully provides an idea of some of the potential variables at play.

Answer 2

Yes. With a cold boot attack.

Depending on the software used to encrypt your data and when the attacker gets a hold of your laptop, there is a good chance that they can get access to whatever they want, if they know how.

The problem lies in the fact that many disk-encryption tools, including BitLocker, store the keys in RAM. The trick to the attack is to cool the RAM down.

This attack relies on the fact that the RAM in your laptop will retain its information, even after power loss, for a certain amount of time. If you cool the RAM down, it will retain its information, without power, for longer. The researchers did this by spraying compressed air or liquid nitrogen onto the RAM modules while the laptop was running. Then they removed the modules and loaded them into their own specialised system.

On all of our sample DRAMs, the decay rates were low enough that an attacker who cut power for 60 seconds would recover 99.9% of bits correctly... This suggests that, even in modern memory modules, data may be recoverable for hours or days with sufficient cooling.

From there, they could inspect the contents of the memory and look for important information like DES, AES, or RSA keys. Using algorithms to scan the loaded memory, you can detect crypto keys.

We have developed fully automatic techniques for locating symmetric encryption keys in memory images, even in the presence of bit errors.

Our experiments (see Section 3) show that it is possible to recover memory contents with few bit errors even after cutting power to the system for a brief time.

---

References:

[ 1 ] J. Halderman et al. "Lest we remember: cold boot attacks on encryption keys" (site contains a link to the research paper).

Answer 3

If your computer ONLY has password for user accounts then extremely easily. You could just load ANY LiveCD and it will ignore the file permissions thus giving the attacker full file rights.

If you have encryption then question is too broad scope we need to know what software you used for encryption and so on. I can expand on my answer if you provide encryption software you used.

Answer 4

You have several different questions here:

If a Windows laptop with an encrypted hard disk is stolen, can the contents be accessed by a professional hacker?

Yes.

In other words, how easy is it to break into Windows without having the passwords for any of the users configured in the computer?

Assuming we're still talking about a machine whose hard drive is encrypted with the built in BitLocker, then as far us we know: it's not easy.

========

But those aren't really the central issue.

The big issue is whether or not the professional hacker in question believes that the data on the drive is worth the amount of time and money necessary to crack it. If we're talking the NSA and you have data related to a high priority national security issue which presumably can't be accessed in any other way (e.g. the person who knows the password is "unavailable"), then they will throw the computing power necessary at cracking it.

However if we're talking about a laptop that was stolen by someone completely unaware of the contents then they'll likely just reformat the thing and ebay it. Heck, they may just pawn/ebay it as is.

In other words, the central question boils down to whether you were just a target of opportunity (petty theft) or were a target of professional surveillance. If the latter then you can bet that they only took the laptop when they felt they had enough information to easily access the drive contents - in other words they managed to get your passwords. It's usually easier (ie: cheaper/faster) to utilize modern surveillance techniques to eaves drop on a password being typed than it is to crack solid encryption. Devices to listen in on keystrokes or even pin hole cameras in a ceiling are certain one option...

A third option is if the laptop was picked up by your local police when they were arresting you. For this it's probably far easier to force you to divulge the passwords (based on various countries laws) than it is to bother trying to crack the laptop. Some countries have fairly lopsided laws in which it would still be in your best interest to give up the password to incriminating evidence than to stay silent.

Answer 5

Hopefully the hard disk is encrypted using BitLocker, which means by default makes your hard disk would be the first device your laptop would boot on. If the hacker tries to change the boot order (reset local admin password using Linux tool), then the BitLocker will be locked (needs to enter 48-characters recovery key to unlock). If the user manages to dismantle the hard disk, the hard disk would be treated as BitLocker ToGo, so the same locking policy applies.

Answer 6

Now it is time to make explicit one fundamental property of the field of Information Security, which pertains to the debate at hand:

This is not a game. There are no rules.

Let's see what this means by first reviewing the "technical answer" (that has been expanded upon by other answers to this question). The "professional hacker" will be kept at bay if all of the following are true:

• The whole-disk encryption system is worth that name.
• When you say whole, you mean whole. Virtual memory space (aka "swap partitions" or "swap files") must also be encrypted.
• The unlocking password is strong (high entropy).
• When the laptop was stolen, it was unpowered and properly shut down (not put to sleep or hibernating, but really shut down).
• The thief runs with the laptop but does not come back.

The point about the laptop being shut down is for cold boot attacks. After a few minutes of being shut down, the RAM contents are definitively lost -- whereas "sleeping" and "hibernation" are techniques to keep the RAM contents alive somewhere (either by using the battery to keep the RAM powered, or by storing its contents on the hard drive).

---

However, the important point is the last one. All of these technical considerations are indicative of anything only as long as the thief is obliging enough to accept to operate within the stated context, the "rules of engagement". Namely, the thief has temporary physical access to the laptop, and just grabs it. He does not try to, say, insert some key logging apparatus or other backdooring system to the laptop, then leave it in place, so that the user, unsuspecting of the hacker's intervention, guilelessly types in his password again, unlocking all his deepest secrets.

This is where the scenario is unrealistic. We are talking about a professional hacker. By definition, that hacker makes a living out of his activities. He is interested in your information, and will not feel compelled to act only within the constraints of an ideal story. Most successful "hacking" stories often include, as pivotal element, a non-technical action, usually so-called social engineering (where the "engineering" term belies the fact that, indeed, this is not about engineering but psychology and sociology), or simple downright burglary. To (ab)use Chamberlain's quote: the professional hacker is not a gentleman.

Now if we were talking about an amateur hacker, then things change quite a lot. The situation becomes the following:

My laptop has been stolen. I was using whole-disk encryption. Will the thief (who was after the hardware, not the information) be able to also recover may Gmail password and steal my accounts?

In that case, we have actual facts which have happened in the physical world, thus a firm foundation for the context in which the question takes place. The laptop was stolen, not silently modified. Whoever did the deed was not, at the time of theft, a professional hacker targeting the data; rather, it was an opportunistic bystander who thought he could make a few bucks out of the laptop itself. If so, properly implemented and applied whole-disk encryption, protected with a strong password on a laptop which was completely off, will save the day, in that it will limit the cost to the loss and lack of availability of the hardware.

Answer 7

It depends on the encoding software. If it used BitLocker, it is possible to crack only the BitLocker password, which is not hopeless with a dictionary attack. To crack the Bitlocker key is normally hopeless.