BitLocker - behavior in sleep mode

Question

Dear QA Team,

I´m trying to find an answer to a specific case I encountered recently but no luck on the internet so far.

• A laptop with TPM 2.0 (ThinkPad L15) with BitLocker enabled got stolen.
• The BL settings were automatic - key stored in TPM, did not ask the user for PW, unless the recovery got triggered.
• When stolen, the laptop was only in sleep mode.
• I know a scheduled task can be set to lock drive while the device goes to sleep but it wasn´t the case of the stolen device yet.

The question is: will the BL lock the drive in case someone would put it in another computer to read the data, even though the laptop was in sleep mode and the drive thus unlocked at that time? I don´t mean any specific/targeted data theft engineering, that cannot be, most likely, avoided with an unlocked drive but more like the drive recognizes the TPM key auth doesn´t add up and lock it. (Also the scenario when someone would try to connect the drive to an already running system, if there´s any difference).

Thank you
Jakub

Answer 1

Sleep has no relevance here. When the drive is connected to another machine, the recovery key is asked for.
When the device was not locked nor configured to automatically lock after sleep (=ask for the user password/ user PIN), the thief can of course see all data that the user logged in could see.