Full-Disk Encryption & TPM Sealing

Full-Disk Encryption

Status

Disk encryption key (DEK)

–

TPM seal

–

Drive location

Original laptop

Data on attacker PC

–

How it works

Full-disk encryption (FDE — the tech behind BitLocker, FileVault, LUKS) encrypts every block on the drive with a symmetric Disk Encryption Key (DEK), typically AES-256 in XTS mode so identical plaintext blocks never produce identical ciphertext. The DEK itself is then wrapped and "sealed" inside a TPM (Trusted Platform Module) — a small hardware chip soldered to the motherboard, not the drive.

boot: TPM measures firmware → bootloader → OS
      hashes match sealed policy?
        yes → TPM releases DEK → disk unlocks
        no  → TPM refuses → disk stays ciphertext

Encrypted toggle — switch full-disk encryption on or off before running the theft scenario.
Simulate laptop theft — detaches the physical drive and plugs it into an unrelated attacker PC, exactly like unscrewing a stolen laptop and mounting its drive elsewhere.
Unencrypted drive — every file is stored as plaintext blocks; any PC that mounts the drive reads it directly. Physical possession equals full data access.
Encrypted + TPM-sealed drive — the DEK never leaves the original TPM chip, which stays soldered inside the stolen laptop. An attacker PC only ever sees ciphertext — random-looking noise with no key to unlock it.

Real-world relevance: this TPM-sealed-to-boot-state design is exactly why a stolen laptop with BitLocker/FileVault enabled protects its data even after the drive is physically removed — the classic "steal the drive, mount it elsewhere" attack simply reads ciphertext.

Readable data Ciphertext (noise) TPM chip (sealed key) Physical drive

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.