If I have a laptop with full disk encryption it's turned on, the screen is locked and it gets stolen. How would an attacker get my data? It's not encrypted at the moment because it's turned on but the only ways that I know of grabbing a password requires you to boot to a cd/dvd/thumbdrive which requires restarting or running an exploit against the machine over the network and stealing the SAM or passwd file.
There are known attacks using DMA and a firewire port that can override the locking screen's protection. Unless certain firewire features that are on by default were disabled, simply plugging in a firewire adapter and running some specialized code can make the lock screen accept any password.
DMA, firewire and coldboot attacks have been already spoken of. But there are more ways to skin a cat.
Your computer may be insecure : shared folders, vulnerable services or kernel, etc. An exploit from the network could give access to then system and then to your data.
Your configuration may be insecure, for example a forgotten unlocked account with easy to guess password, and local privilege escalation, or a default account somewhere.
And, of course, your credentials may have been stolen (
mimikatz is quite good at that).
the best advise is to not use full disk encryption, but make multiple smaller containers which you can lock when you are done working with them,
this will stop attackers from getting all data(if you use strong and different passwords for every container) and allows you to close them more often, there are other problem to consider here because its easier to leak data out of the container
I remember a few years back there was a program called decaf which was to prevent the use of the FBI's tool known as Caffene that will bipass passwords when the computer boots up. Pretty much what it did was disable all ports and extra drives eg: optical drives when the computer boots up. I believe it also may have had a feature that would disable all those ports unless you gave permission.
Of course decaf was taken off the web. But that may give you some idea of how you can protect your computer in future.
It depends on how sophisticated your attacker is. There is a lot that could be done with a running machine, including power analysis when your machine does disk access (maybe due to scheduled tasks) if you were somehow able to prevent all direct access to the key. The video borrel linked to covers a number of things that would be easier in most cases. Not leaving it while it is running does provide much better protection, although an attacker who really wants your data can still install a bootkit then steal it later when the bootkit has your password (or install a more complicated bootkit that provides the information and perhaps full system access via the network). My understanding is that TPM is effective against that attack, although the attacker could still install a keylogger, which could be an audio recorder that is analysed for the distinctive sound different keys make.
Even if stolen while running, full disk encryption can help against someone who is mostly interested in the resale value of the hardware and might not bother to try even the easier attacks against full disk encryption. If you use commercial software, it might save you from having to call each vendor to explain why their DRM is now showing two copies of their software installed with your license. You can still add additional encryption on more valuable data if that makes sense for you. It all depends on what threats are most likely and how much effort you are willing or required to make to protect against them. Someone wanting data may often find it easier or more appealing to use network based attacks.