I'm using a TrueCrypt encrypted hard drive on my computer where I store all my work files. Usually, when I leave my laptop, I simply lock the Windows session but leave the TrueCrypt drive mounted.
Now I'm wondering, if someone steals my laptop when it's in this state (i.e. TrueCrypt drive mounted but with locked session), is it possible for them to access the data on my encrypted hard drive?
I realize that unmounting the drive is the safest way but I often have several processes running from it and I don't want to close everything if I leave just for 5 minutes.
Assuming the thief doesn't know my session password and didn't install a keylogger on my machine (and doesn't have access to hightech tools from the NSA :), is it possible for him to bypass the Windows login screen and access my TrueCrypt data?