When using Bitlocker and I am logged into a PC is the data accessible for outside devices? (mounted)

Question

I am wondering what happens when I log into an encrypted Windows PC - could an attacker steal data from the PC while logged in or is it encrypted and to access the drive he would need the Bitlocker key? Does it actually prevent data breaches?

Answer 1

If the attacker is running code with the permissions of the user (like when the users started malware from a phishing mail) then it has also access to all the data the user has access too, which include data on the mounted bitlocker volume.

Disk encryption is more about protecting data when they are not mounted, i.e. protect access to data on a lost or stolen notebook or external drive. In this case they are valuable to prevent data breaches. They don't protect against an attacker which has compromised the system though.