A laptop stolen on a train or a disk forgotten in a decommissioned office are among the most mundane causes of data leaks. Without encryption, anyone can remove the disk, connect it to another computer and read documents, saved emails and passwords stored in the browser. Full-disk encryption closes that door, and it is now available at no cost on every major operating system.
How full-disk encryption works
The idea is simple: everything written to the disk first passes through a symmetric encryption algorithm, almost always AES, and is decrypted on the fly when read. Nothing changes for the user: files open as usual, and thanks to the hardware instructions in modern processors the performance hit is barely noticeable.
The key structure has two levels:
- a data encryption key, random and very strong, actually encrypts the contents of the disk;
- this key is in turn protected by one or more protectors: a password, a PIN, a TPM chip, a recovery key.
This scheme lets you change your password without re-encrypting the whole disk: you simply re-encrypt the small data key with the new protector. Likewise, you can have several ways to unlock the same disk.
Disks use purpose-built modes of operation such as XTS, which allow each sector to be encrypted and decrypted independently.
The three main tools
| System | Tool | Main notes |
|---|---|---|
| Windows | BitLocker | Built into Pro editions and above; on many devices running Windows Home a simplified version called device encryption is available |
| macOS | FileVault | Built in, switched on from the security settings |
| Linux | LUKS | The de facto standard, offered by many distributions during installation |
There are also cross-platform solutions such as VeraCrypt, useful for encrypting external drives or creating encrypted containers to use on different systems.
Modern smartphones, both Android and iPhone, encrypt their internal storage by default, tying the protection to the unlock code.
The role of the TPM and security chip
Many computers include a TPM (Trusted Platform Module) or an equivalent security chip. This component can hold the disk key and release it only if the system boots normally, with no changes to the boot process.
The advantage is convenience: the disk unlocks automatically at power-on. The limitation is that, with the TPM alone, someone who steals the computer while it is on or asleep faces the normal login screen, and protection depends on the account password. For devices holding sensitive data, adding a pre-boot PIN, entered before the operating system starts, is advisable.
What disk encryption really protects
Full-disk encryption protects data when the device is switched off. That covers theft, loss, disposal of an old disk or repair at an outside workshop.
It does not protect:
- a computer that is on and unlocked: at that moment the disk is accessible to whoever sits in front of it, and to any malware running;
- files copied elsewhere: a USB stick, an email attachment or an unencrypted backup remain readable;
- weak credentials: if the password protecting the key is easy to guess, the encryption is only skin-deep.
An important practical detail: sleep mode leaves the key in memory. If you carry your laptop into risky situations, shutting it down completely, or using hibernation, gives stronger protection.
The recovery key: do not lose it
When you enable encryption, the system generates a recovery key. BitLocker, for example, presents it as a 48-digit numerical code. You need it when normal unlocking fails: a firmware update, a motherboard replacement, a forgotten password.
Without the recovery key, the data is lost. There is no "back door" to recover it: that is the whole point of encryption. Some guidance:
- keep it away from the encrypted computer, for example printed in a safe place or stored in a password manager;
- if you save it in the operating system vendor's cloud account, be aware that anyone who accesses that account can retrieve it;
- note which device it belongs to, especially if you manage more than one.
External drives and backups
Encrypting the internal disk does not automatically extend to external drives. BitLocker To Go, macOS's encrypted formatting options and LUKS also let you encrypt removable drives. A full computer backup left unencrypted on an external disk defeats the protection of the main disk.
In short
- Full-disk encryption makes the data on a switched-off, stolen or discarded device unreadable.
- BitLocker, FileVault and LUKS are built into their respective systems and typically use AES.
- The TPM makes unlocking convenient; a pre-boot PIN increases protection.
- Protection does not apply to a computer that is on and unlocked, nor to files copied elsewhere.
- The recovery key must be kept carefully: without it, the data cannot be recovered.
