Certified Ethical Hacker (CEH) Practice Question

When BitLocker is configured in TPM-only mode, the drive is automatically unlocked once the operating system starts. While the screen is merely locked or the computer is in sleep/stand-by, the full-volume encryption key remains resident in DRAM. A cold-boot attack exploits the data-remanence property of RAM by rapidly power-cycling the machine, then copying the memory contents to another medium before they decay. The captured image can be searched for the 128-bit or 256-bit AES key that BitLocker uses, allowing the tester to decrypt the entire drive.

Brute-forcing the AES-XTS header is computationally infeasible with current technology, extracting the key directly from TPM non-volatile storage is ineffective because the key is never stored there in plain form, and copying the SAM/SYSTEM hives only helps recover Windows logon credentials, not the in-memory disk-encryption keys.