Re: TPM and Bitlocker
TPM Bitlocker is meant to block physical transplanting of the drive (think an Evil Maintenance Guy attack), and if set accordingly there's no way to bypass it. If it isn't in the same machine as that specific TPM, it's no-go, full stop.
That's not actually completely correct. If you have the Volume Master Key (or indeed the Full Volume Encryption Key), you can decrypt the storage device without the TPM.
The Full Volume Encryption Key (FVEK) is encrypted with the Volume Master Key (VMK) , and stored on the storage device. What's more, if you have a recovery key enabled, then the Volume Master Key is encrypted with the Recovery Key and stored on the storage device. So far, no TPM involvement.
So if you have the FVEK, you can decrypt the device.
If you have the VMK, you can decrypt the device.
If you know the recovery key (and that function is enabled), you can decrypt the device.
All without the TPM.
Getting hold of the above is quite possibly difficult, but not impossible.
Pulse Security: Extracting BitLocker keys from a TPM
Elcomsoft: Unlocking BitLocker: Can You Break That Password?
Note that:
If you have a modern device that supports automatic device encryption, the recovery key will most likely be in your Microsoft account. For more, see Device encryption in Windows 10.
From: Microsoft: Finding your BitLocker recovery key in Windows 10
So getting hold of your storage device's recovery key could be 'as simple' as compromising your Microsoft Account.
NN
Biting the hand that feeds IT
