TPM Bus Sniffing for BitLocker VMK

With physical access to a discrete TPM connected over an exposed LPC bus, capture boot-time TPM traffic to recover a BitLocker volume master key (VMK) where TPM-only startup automatically releases it. Published demonstrations cover specific LPC-connected TPM 1.2 and TPM 2.0 systems; results depend on motherboard wiring, boot/PCR state, protector configuration, and bus protections. This does not recover a BitLocker recovery key or a TPM private key, and does not generalize to firmware TPMs or every TPM 2.0 platform.