11

I had left my laptop in an untrusted place for a while and I see signs of the back cover having been opened. Could it be possible for someone to have copied the contents of my SSD?

Windows 10 Home
Device encryption: On

Asus TUF Dash Gaming F15
Purchased August 2022

Does device encryption being On in Windows 10 Home (no BitLocker) prevent the contents of my SSD from being read if someone just plugs it into an adapter and uses it as an external drive? Or could it still be vulnerable?

6
  • 3
    Have you read Device Encryption?
    – Ramhound
    Jan 27, 2023 at 18:31
  • unless you left it at a Blackhat conference or something you are almost certainly fine, especially if it was fully powered down and had been for more than a few minutes. Jan 27, 2023 at 19:12
  • 6
    How realistic is this? Why would someone go through trouble of opening laptop, take out drive, copy, put drive back as if nothing happened and doing a sloppy job because back appears to have been removed? .. rather than just steal the laptop? Jan 28, 2023 at 14:20
  • 5
    @JoepvanSteen: without going into details, there have been plenty of instances of something very similar in the pre full disc encryption era. This is for any kind of data where the supicion of someone else obtaining it would trigger some series of events that the thief does not want to happen...
    – PlasmaHH
    Jan 28, 2023 at 20:05
  • This sort of attack would be called an evil maid attack. There are a lot of things they could do other than try to copy your hard disk, e.g. install malicious firmware. Sleep well.
    – John Wu
    Jan 29, 2023 at 7:13

3 Answers 3

15

No, Windows 10 device encryption is full disk encryption.
This exact scenario and solution is described on Microsoft's website:

If somebody wants to bypass those Windows protections, however, they could open the computer case and remove the physical hard drive. […]

If your drive is encrypted, however, when they try to use that method to access the drive, they'll have to provide the decryption key (which they shouldn't have) in order to access anything on the drive. Without the decryption key the data on the drive will just look like gibberish to them.

https://support.microsoft.com/en-us/windows/device-encryption-in-windows-ad5dcf4b-dbe0-2331-228f-7925c2a3012d

4
  • It depends on the SSD... A lot of cheap SSDs store the encryption keys in ways that are fairly easy to retrieve Jan 29, 2023 at 17:09
  • @ScottishTapWater the internal encryption of the SSD os another thing (and its purpose is not to prevent reading the SSD)
    – PierU
    Jan 29, 2023 at 17:19
  • If I'm not mistaken, it's quite common for bitlocker to offload the encryption to the SSD itself Jan 29, 2023 at 18:02
  • There's also the scenario of an attacker seeing the encryption is off (or finding some way to turn it off!), copying the data then turning the encryption on... not likely if the machine was not unattended for long, though. Jan 29, 2023 at 18:13
6

As grg says, if the attacker only takes the SSD or reads the data from it, you should be relatively safe.

If you allow the attacker to remove the SSD from the computer, it is also possible for it to perform modifications that allows obtaining the encryption key. This can range from relatively simple software modifications¹ to modification of the hardware (like installing a hardware keylogger). Therefore, if you leave your computer unsupervised, it is possible that such modifications were done. Since it is usually not affordable to thoroughly check the computer before each use, you should also protect it physically, if you care about you data a lot.


¹Secure boot should help with this at least a bit.

3
  • 1
    "This can range from relatively simple software modifications" - citation needed.. Jan 28, 2023 at 14:31
  • @JoepvanSteen, yes, I could add some citations (later). As an example of that, you can modify or even replace the OS (with an OS that prompts the user for credentials and sends them to the attacker). If you are not using SecureBoot or the motherboard allows disabling it and replacing the OS, you are never safe. Consider this scenario: 1. take a disk image of the disk; 2. replace the OS with software which asks the user for credentials and sends them over the Internet; 3. the user does not notice that the SO has changed, provides the credentials to the attacker.
    – jiwopene
    Jan 28, 2023 at 14:36
  • 2
    For citations: It could be the equivalent of something like the Hak5 Rubber Ducky or WiFi Duck: "By emulating a USB keyboard, this device can be used to remote control a computer, automate tasks or execute software to gain full access." (keystroke injection attacks). Jan 28, 2023 at 16:42
-1

The actual answer to "Could it be possible for someone to copy the contents of my SSD and save it?" is: Yes!

While the contents may be encrypted, the hostile has a lot of time to try to break encryption.

Also the answer for "Can someone read my data if they open up my laptop and steal the SSD?" is that they don't have to steal the SSD (see above). The difference most likely is that you realize if your SSD is missing, but not if it was coipied.

4
  • 7
    Not the several trillions of years that, absent a mathematical breakthrough, it would take with just the SSD.
    – wizzwizz4
    Jan 29, 2023 at 1:28
  • 1
    It doesn't even have to be brute force. I am no expert but I have seen examples of encryption being bypassed or some other weakness exploited that convinced a device to deliver decrypted data. I don't think this answer deserves the downvote. It is correct if we consider the answer to 'can it be copied?'. Jan 29, 2023 at 17:11
  • Well, maybe the question should have been different, but that's the true answer to the question as it was. Also "data" is different from "information".
    – U. Windl
    Jan 30, 2023 at 7:27
  • @JoepvanSteen The answer is implicitly about brute force when talking about "a lot of time" and doesn't elaborate at all what could be the means. One expect answers that are not only yes/no on this site.
    – PierU
    Jan 30, 2023 at 8:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .