> What's the point of encrypting your disks if the computer automatically decrypts them anyway? The important detail you're missing is: the computer automatica

> What's the point of encrypting your disks if the computer automatically decrypts them anyway? The important detail you're missing is: the computer automatically decrypts your disks if you're booting into that operating system. Try booting into something else (like a Linux CD), and you'll see that the TPM does not release the encryption key (the way it works is that each step of the boot sequence records into the TPM what's going on, and the TPM will only release the key if the sequence matches what it expects). The point is that the disks will only be decrypted when booting into the expected OS, and that this OS will require you to login before giving anyone access to your files. > The only situation I can see where this helps you is if someone steals your disk but not your computer, but that seems very unlikely to me. It'll also help if someone steals the computer but does not have your login password; they can boot into Windows, the files will be decrypted while booted into Windows, but without logging into your account, they are not accessible. Of course, unless you're using memory encryption (which I don't think is normally available on normal non-server devices), someone with the right hardware knowledge and an expensive set of hardware tools could in theory manipulate the RAM to get access.