In order to prevent cold-boot attacks against an encrypted Android filesystem, it has been recommended to keep your bootloader locked at all times with the original factory recovery installed.
The original question primarily addresses Nexus devices, which use
fastboot to control bootloader access and feature a command
fastboot oem lock by which to prevent unauthorized flashing.
My workflow on my Nexus devices has been to keep a PGP-signed version of the stock recovery around on the device, flash a recovery to the recovery partition while the phone is still running (
dd if=openrecovery.img of=/dev/block/.../recovery), boot into recovery, backup, flash away, then reboot. If everything is well, verify the signature on the stock recovery and flash it similarly to how we flashed the recovery.
This process makes sure that cold-boot attacks are impossible, unless I forget to reflash the stock recovery, which I haven't failed to do yet.
How does this process work with Samsung phones? I have a Samsung Galaxy S5 (G900T) with a custom recovery installed. I can easily get the stock recovery. However, how do I "lock" the bootloader, for lack of a better term? There's nothing I know of in Odin which would allow me to lock the device.
Is this possible with Samsung phones?