Is filesystem encryption any good if someone steals my computer while it's on?

Question

I'm using Ubuntu 12, and during installation I have chosen to encrypt the disk and home directory.

I only introduce the disk password the first time I log in, so I guess the disk is not encrypted when I lock the screen.

But what about home directory? Is it encrypted while the screen is locked?

I'm thinking that when I'm running this inside a VM (with its screen locked), someone with access to the host machine (not the VM) could access the VM's disk because it's just a file in the host machine, right? And since the VM is running, it's not encrypted, and the attacker doesn't even need to unlock the screen.

So then I thought, what would happen if I were running this as a host (not a VM), with the screen locked, and someone unplugged the disk? Would it stay unencrypted? That way the attacker doesn't even need to scan the ram looking for the key.

Answer 1

While the contents of the disk are encrypted, the operating system is decrypting the content of the disk on the fly in order to access it. The screen lock does little to protect the contents of the disk while the computer is running.

All the screen lock does is prevent someone from running programs / reading your screen while you're away. As long as the computer is running and the encrypted disk mounted, your data is vulnerable. Granted most thieves would just shut the machine off / reboot it once they had it.

However, if you're paranoid about your data, the inconvenience of powering down/powering up every time you walk away for a while is a small price to pay IMHO.