A 2D top-down schematic of the same mechanism as the 3D version, plus the piece that scenario left implicit: what happens when an attacker tries to guess the TPM's PIN/passphrase instead of just reading the ciphertext. Real TPMs (per the TCG spec) implement dictionary-attack protection — each wrong guess increases a lockout counter, and the wait time before the next guess grows exponentially.
- Encrypted toggle — turn full-disk encryption on/off before stealing the drive.
- Simulate laptop theft — moves the physical drive from the original laptop to an attacker's PC. The TPM chip never leaves the original board.
- Try TPM PIN guess — only relevant once stolen + encrypted: each click is one guess against the (still-attached) TPM's anti-hammering counter, doubling the lockout delay until it saturates — modelling why brute-forcing a TPM-sealed key is infeasible even with physical possession of the drive.