What Stephen says in the comment is correct. It is safe to not use authenticated encryption whenever your adversary model assumes that the attacker does not have the ability to manipulate ciphertexts.
I assumed hard drive volume encryption or per file encryption that is not transmitted over an insecure network should be considered safe to do without a MAC. Is that right?
What if the attacker can install a program on your machine that can modify the ciphertext? It all depends on adversary model.
The advantage might be that if you do not provide a MAC, an attacker that has gained access to the physical storage and performing a brute force search does not know if they have successfully decrypted the volume/file as they do not have the MAC to verify that the key is correct. Perhaps an attacker could try decrypting and testing if decryption matches English phrases, however there could be multiple keys that produce valid plaintexts.
In practice, for most applications, it will be pretty easy to know when they got the right key. But also, in practice, brute force is not the attack you should be worried about. Very rarely does the attacker attack the cryptography. They usually attack other pieces (password entry, key generation, key storage, side channels, etc) to render the crypto useless.
What is done in practice, do programs like TrueCrypt or Keepass perform authenticated encryption?
Truecrypt does not provide authenticity and integrity.
It looks like keepass does provide integrity protection, but I couldn't quickly find anything that says exactly how. See the relevant quote from here:
In repair mode, the integrity of the data is not checked (in order to rescue as much data as possible). When no integrity checks are performed, corrupted/malicious data might be incorporated into the database. Thus the repair functionality should only be used when there really is no other solution. If you use it, afterwards you should thoroughly check your whole database for corrupted/malicious data.
