An attacker with physical access can abruptly restart the device and dump RAM, as analysis of this memory may reveal FVEK keys from recently running Windows instances, compromising data encryption.

The effectiveness of this attack is, however, limited because the data stored in RAM degrades rapidly after the power is cut off.

  • @Cornelius_Wangenheim
    link
    English
    32 days ago

    All secure implementations of Bitlocker also use a password on boot. Use of a TPM is not unique to Bitlocker either.