No password protection on a removed hard drive?

[David]

I am going to have some hardware repairs done on my laptop. In order to make
sure I will not lose any data, I removed the hard drive from the laptop, put
it into a hard drive enclosure, and connected it to a USB port on my desktop
computer. I was able to back up all the HD data from the laptop onto the
desktop.

I was able to access the data for all users on the laptop without having to
enter any user account passwords.

Does this mean that if someone were to steal my laptop and they wanted to
get access to the data for all my user accounts, all they would have to do
is remove the HD, connect it to another computer, and then copy all
unencrypted data?

To put it another way: Is the protection provided by user account passwords
only effective when the hard drive is installed in the computer on which
those user accounts are established?

David

 

[FromTheRafters]

I am going to have some hardware repairs done on my laptop. In order to
make sure I will not lose any data, I removed the hard drive from the
laptop, put it into a hard drive enclosure, and connected it to a USB
port on my desktop computer. I was able to back up all the HD data from
the laptop onto the desktop.

I was able to access the data for all users on the laptop without
having to enter any user account passwords.

Does this mean that if someone were to steal my laptop and they wanted
to get access to the data for all my user accounts, all they would
have to do is remove the HD, connect it to another computer, and then
copy all unencrypted data?

They wouldn't have to remove the harddrive - only to boot from another
OS on a LiveCD disk.

To put it another way: Is the protection provided by user account
passwords only effective when the hard drive is installed in the
computer on which those user accounts are established?

Not even on that computer - that computer running a separate software
environment is enough.

Encryption is king.

 

[Bruce Chambers]

I am going to have some hardware repairs done on my laptop. In order to
make sure I will not lose any data, I removed the hard drive from the
laptop, put it into a hard drive enclosure, and connected it to a USB
port on my desktop computer. I was able to back up all the HD data from
the laptop onto the desktop.

I was able to access the data for all users on the laptop without having
to enter any user account passwords.

Does this mean that if someone were to steal my laptop and they wanted
to get access to the data for all my user accounts, all they would have
to do is remove the HD, connect it to another computer, and then copy
all unencrypted data?

To put it another way: Is the protection provided by user account
passwords only effective when the hard drive is installed in the
computer on which those user accounts are established?

David

It wouldn't matter whether or not the hard were to be removed from the
laptop. Without physical security, there is *NO* security. If your
laptop or its hard drive is mislaid or stolen, your data can easily be
accessed by anyone with a small amount of knowledge and the correct
tools. User account passwords are essentially useless; they're
certainly no deterrent to the dozens of free, Linux-based password
cracking utilities readily available to anyone who can use Google. Even
encryption is no 100% guarantee of security, although it would serve to
discourage the casual thief.


--

Bruce Chambers

Help us help you:


http://support.microsoft.com/default.aspx/kb/555375

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. ~Benjamin Franklin

Many people would rather die than think; in fact, most do. ~Bertrand Russell

The philosopher has never killed any priests, whereas the priest has
killed a great many philosophers.
~ Denis Diderot

 

[Gary G. Little]

That's a great big Ten-Four good buddy. Unless you encrypt the data, and
that is best done with a full disk encrypting hard drive, the HDD can be
accessed via any number of means other than physically removing it from the
laptop.