Unlikely that the KEK on the TPM is moved into RAM. The TPM would internally decrypt the KEK encrypted DEK, and then use the DEK in RAM (more likely it's just i

Unlikely that the KEK on the TPM is moved into RAM. The TPM would internally decrypt the KEK encrypted DEK, and then use the DEK in RAM (more likely it's just in the CPU using AES-NI, finding it in RAM would be non-trivial assuming the implementation is good). This is compared to e.g. either Linux (LUKS) or OS X where the encrypted DEK is stored on the drive itself (outside of the encrypted volume of course), since neither of them leverage a TPM at the moment.