Cold boot attack
An attack that reads encryption keys out of DRAM after the machine is switched off, because memory cells keep their contents for a while.
DRAM loses its contents gradually after power is cut, and more slowly if the chips are cooled. In 2008, Halderman and colleagues at Princeton showed that with a chilled memory module and a quick reboot, you could read out AES and RSA keys, and from them reach BitLocker and dm-crypt volumes. The attack needs physical access, but the window is longer than most people assume.
The defences are to keep keys out of plaintext RAM: encrypt memory contents, overwrite memory at shutdown, or keep keys in CPU registers and in an HSM. That raises the bar without solving the problem, since someone with physical access to the machine can do far more than read memory.