Apple’s disk encryption can be easily defeated by connecting a specially crafted device to a locked Macbook. Devices connected over Thunderbolt can access the computer’s RAM directly before the OS is started. The password for Apple’s FileVault 2 disk encryption is stored in memory in plain text if the disk has been unlocked once. The only time the password is removed from memory is when the Mac is shut down. The attack is possible because the EFI (Extensible Firmware Interface) initializes Thunderbolt devices at an early stage in the boot process.”]