Suppose a full-disk-encrypted computer with hot-swappable hard drives is powered on (i.e. decrypted at boot by a trusted user) but is screen-locked.
In such a case, if an attacker with physical access were to remove and walk off with one of the disks (not the whole computer, just a disk), would they have free access to the data stored on it? Like, literally just mount the disk to a separate computer and start browsing? If the answer is yes, is there any way to mitigate this specific scenario?
Caveats: I understand that an attacker with physical access has a myriad of attack vectors other than the one I mentioned, and so "don't allow physical access" is the number one mitigation measure. The only similar question I can find deals with the whole computer being nabbed, not just a disk.