Disk encryption protects data only when a device is powered off, as the encryption key is stored in RAM while the system is running. When a laptop is in sleep mode, the key remains in memory, leaving data vulnerable if the device is accessed.
Modern corporate laptops often use TPM for automatic key release during boot. Without a pre-boot PIN, this configuration only protects against physical disk removal, not against unauthorized access to a stolen, powered-on device.
Hibernation offers higher security than sleep because it clears the encryption key from RAM. However, this requires the swap partition to be encrypted and a pre-boot PIN to be configured to prevent automatic decryption upon waking.
External interfaces like Thunderbolt and USB4 can potentially access RAM directly to extract keys. Modern systems mitigate this using IOMMU, though it must be verified as enabled. Encryption also does not protect against ransomware or unauthorized system access.
