Exercise 1: Why a Removed BitLocker Drive Stays Unreadable — Possible Solution ==================================================================== WHAT ACTUALLY UNLOCKS A BITLOCKER-ENCRYPTED DRIVE ------------------------------ Per this chapter, "BitLocker encrypts an entire drive, decrypting it transparently the moment Windows boots successfully and the TPM... releases the encryption key." The encryption key itself isn't stored in an easily portable form on the drive - it's sealed inside the TPM chip, physically part of the original machine's own motherboard, not the drive being moved. WHY MOVING THE DRIVE BREAKS THAT UNLOCK MECHANISM ------------------------------ Per this chapter, "if the drive is removed and connected to a different machine, or if the boot process is tampered with, the TPM refuses to release the key at all, and the drive remains fully encrypted and unreadable." A different machine has a different TPM chip - one that never sealed this specific drive's encryption key in the first place, and therefore has no key to release regardless of how the drive is connected to it. WHY CHAPTER 2's TPM MATERIAL IS THE ROOT OF THIS BEHAVIOR ------------------------------ Chapter 2 covered TPM 2.0 as a Windows 11 installation requirement specifically because it provides a hardware-bound place to store encryption keys "outside the reach of the operating system itself." BitLocker is a direct, practical application of exactly that property: the key genuinely never leaves the TPM it was sealed to, so a drive separated from its original TPM has no legitimate path to decryption at all, regardless of what tools or hardware someone connects it to. WHY THIS IS A GENUINE SECURITY GUARANTEE, NOT JUST A DEFAULT SETTING ------------------------------ This isn't a permission check that a determined attacker could bypass with the right privileges - the key simply doesn't exist anywhere accessible outside that one specific TPM chip. Physical drive theft, the exact threat this chapter names BitLocker as protecting against, is defeated precisely because the stolen drive carries no usable key with it. WHY THIS WORKS AS AN ANSWER ------------------------------ It explains where the BitLocker key actually lives (the TPM, not the drive), connects that directly back to Chapter 2's own explanation of what a TPM is for, and explains why this makes the protection a genuine hardware-bound guarantee rather than a settings-level restriction that could otherwise be bypassed.