Because the infected hard drive is not running, malware cannot defend itself. It is essentially "asleep," allowing the bootable scanner to see every file without interference.