Skybuck Flying <skybuckflying@gmail.com> writes:
>With software emulation in chip/bios, where are these keys physically store=
>d ???
>
>I just had a conversation with somebody on the Phone.
>
>His daughter bought a new laptop, probably with windows 11 and encrypted dr=
>ive.
>
>I was wondering:
>
>Suppose the laptop is damaged and non-operational, theoretically the harddi=
>sk could be extracted and move into another laptop.
>
>However if the drive is encrypted, TPM keys will be necessary ?!
>
>How hard is it to write down the TPM keys on a piece of paper ?!?!
>
>How hard is it to move the TPM keys to another/new computer ?!?!

I am not an expert, but AFAIK the idea behind TPMs is that they don't
allow getting the key out.

You can set a new key, but if the drive is encrypted with the old key,
this does not help and it can hurt.

My recommendation is to perform backups regularly, not just for this
reason. And don't encrypt your backup drive with the TPM of the laptop.

- anton
--
'Anyone trying for "industrial quality" ISA should avoid undefined behavior.'
Mitch Alsup, <c17fcd89-f024-40e7-a594-88a85ac10d20o@googlegroups.com>

Anton Ertl wrote:
> Skybuck Flying <skybuckflying@gmail.com> writes:
>> With software emulation in chip/bios, where are these keys physically store=
>> d ???
>>
>> I just had a conversation with somebody on the Phone.
>>
>> His daughter bought a new laptop, probably with windows 11 and encrypted dr=
>> ive.
>>
>> I was wondering:
>>
>> Suppose the laptop is damaged and non-operational, theoretically the harddi=
>> sk could be extracted and move into another laptop.
>>
>> However if the drive is encrypted, TPM keys will be necessary ?!
>>
>> How hard is it to write down the TPM keys on a piece of paper ?!?!
>>
>> How hard is it to move the TPM keys to another/new computer ?!?!
>
> I am not an expert, but AFAIK the idea behind TPMs is that they don't
> allow getting the key out.
>
> You can set a new key, but if the drive is encrypted with the old key,
> this does not help and it can hurt.
>
> My recommendation is to perform backups regularly, not just for this
> reason. And don't encrypt your backup drive with the TPM of the laptop.
>
> - anton

A bit of searching finds that Windows has a 48-digit "recovery key"
(appears to be hex) which one must save in a file or on a USB or
maybe the system admin made a copy when installing the OS.

I gather that if you don't have a recovery key you are toast.

There appears to be a DOS command line tool "manage-bde"
which amongst its features allows display/saving the key.

But there are also ten tonnes of other factors,
like which Windows license do you have (OEM, Retail, Volume),
who installed the OS, how was it set up, who administers the OS,
how different is the new system hardware from the old one, etc.
which may interact.

The general impression I came away with was that if you allow
Microsoft to encrypt your data then you should get answers to these
questions before you NEED answers, because after may be too late.
(And I don't know how one could test that such a disk transplant
would work without actually moving the disk to a different machine.
And doing such a test might trigger Microsoft license restrictions.
Which means you are just taking it on faith that it will all work
in a crunch when it needs to.)