Where is the key stored? Itll have to be in memory so that means it can be extracted from there if the pc is on. If the pc is off then things change. But this discussion assumes the attacker can place files on the system which means they can tamper with possibly timestamps blocks. If the system is encrypted and off then they can't add files and obviously not tamper with blocks either.