The advantage isn't huge but it does exist. Stealing encryption keys out of memory is a reasonably common thing for more sophisticated malware to do, because if

The advantage isn't huge but it does exist. Stealing encryption keys out of memory is a reasonably common thing for more sophisticated malware to do, because if you can opportunistically do it once it generally confers permanent access to the encrypted data whenever you want. Copying the contents out isn't very desirable because 1) it is slow and bandwidth intensive which means it is less likely to succeed opportunistically and more detectable, 2) you will not be able to examine the data again in the future (including changes) without finding an opportunity to copy it out again. It is also often just easier for someone with malicious intent to subtly capture the encrypted volume (can be sent out very slowly without worrying about user behavior) and then examine it remotely (easier and safer to use/iterate on custom tools when you're not shipping them to the compromised machine). This way malware, especially like a plugin-based botnet, can continuously check for the key and grab it whenever it's in memory. Then later on, as convenient, plugins can search the encrypted volume for specific signatures whenever they want. That includes loading more signatures in the future, rescanning for changes, etc. All in all, the ability to extract the key from memory violates the fundamental assumption of the user that the data is not accessible when they have not mounted the volume... it means that if the volume has ever been mounted, unauthorized software might have captured the information necessary to examine it as desired, in a subtle way. Elcomsoft is also principally a forensic vendor, and this kind of thing is very useful in forensics scenarios when you encounter a live machine (e.g. law enforcement seizure). If you can capture the key from the live machine quickly, you can do your analysis later at leisure and with less risk of contamination of the evidence. This minimizes the need for complex and risky methods like transporting the machine without power interruption. Obviously this kind of problem is not necessarily completely solvable... if the data was decrypted then there was, at some point, the material to decrypt it present on the system. But more modern disk and file encryption solutions tend to use various solutions like the TPM and operating system features to avoid the key being available in memory. Finally, as always, password reuse is an issue here. If you can get the key material there's a good bet it might work on other volumes as well if you can recompute for whatever the volume salt is... this may be more or less practical depending on how TrueCrypt/VeraCrypt derives the key which I don't remember well.