Can someone access a mounted TrueCrypt drive if they stole my laptop?

Question

I'm using a TrueCrypt encrypted hard drive on my computer where I store all my work files. Usually, when I leave my laptop, I simply lock the Windows session but leave the TrueCrypt drive mounted.

Now I'm wondering, if someone steals my laptop when it's in this state (i.e. TrueCrypt drive mounted but with locked session), is it possible for them to access the data on my encrypted hard drive?

Some clarifications:

I realize that unmounting the drive is the safest way but I often have several processes running from it and I don't want to close everything if I leave just for 5 minutes.

Assuming the thief doesn't know my session password and didn't install a keylogger on my machine (and doesn't have access to hightech tools from the NSA :), is it possible for him to bypass the Windows login screen and access my TrueCrypt data?

Answer 1

You really have nothing to worry about if you are a regular user and a common thief takes your laptop as they would not know how to retrieve your data or even care to do so. If you are being targeted for your data the thief could do a few things.

1. Use a DMA port such as Firewire to hook up another computer and save the RAM then recovery the encryption keys (see Passware)
2. Use something to cool the RAM sticks down and then use a utility to save the RAM to a flash drive or remove the sticks and put them in another computer.
3. Possible recover the key from pagefile.sys or hiberfil.sys

If you want to avoid those attacks you would need to use truecrypt full disk encryption and utilize hibernate. It should require the password again to boot it from hibernation.

If you do not want to hibernate you should disable it powercfg -h off and set your page file to be encrypted by running fsutil behavior set encryptpagingfile 1. The pagefile is encrypted with a random key generated at boot and lost at shutdown.

Then set the computer to boot from the HDD first and set a BIOS password this would hinder someone attempting to cool the ram and use the same computer to recover it. It would not prevent them from doing it but it might slow them down enough that the data is lost while they are trying to clear the CMOS.

If you have FireWire and you do not use it you should disable it in the BIOS to avoid that kind of attack.. another port that has DMA is the new Thunderbolt one but its not out yet.

Answer 2

The practical answer is no. However, if you are a high value target, like a spy, then a determined adversary would take your computer, and then use various methods to read the RAM and sniff out the keys. If you're really concerned about this scenario, you should always shut down your computer AND since RAM can be sniffed for a while after removing power, you should watch the laptop for 5 or 10 minutes after shutting it down.

Answer 3

Once a truecrypt drive is mounted it's 'available', so in your situation the only barrier between the drive and any would-be snooper is the locked Windows session - so your data is as secure as you make your Windows password.

If you are really worried about someone accessing your data you should unmount the TrueCrypt drive whenever you leave the machine unattended or when you don't need to access it.