Full-disk encryption is supposed to be the last line of defense when a laptop is lost, stolen or otherwise falls into the wrong hands. But good cryptography cannot save a system whose surrounding trust chain makes the wrong decisions. This lecture reviews several Windows security failures from the last few years that demonstrate exactly that problem, focusing on attacks where BitLocker remains cryptographically intact while access to the protected system or data becomes possible anyway. We will follow the chain from firmware, TPM, Secure Boot and DMA protection through the Windows boot process and Windows Recovery Environment, examining recent BitLocker security-feature bypasses, the 2025 WinRE-related vulnerability wave, 2026’s YellowKey/CVE-2026-45585, TPM-only assumptions and physical DMA attack paths. Rather than treating each CVE as an isolated programming mistake, the talk looks for the recurring architectural theme: recovery features, backwards compatibility, hardware trust and usability decisions repeatedly create privileged paths around controls that appear much stronger from the user interface.