Full-Disk Encryption

Full-disk encryption encodes the entire contents of a storage device and only decrypts it once the correct key is presented. On a powered-off or locked device, the contents are unreadable. It is the single most effective control against device loss and theft.

What it protects against

• A stolen, powered-off laptop. The disk contents are ciphertext.
• A stolen, powered-on but locked device, provided the key is held in hardware.
• Recovery of files from a discarded or resold drive, which is the case most often forgotten.
• Untargeted disk-imaging attacks, where an adversary pulls the drive and processes it offline at leisure.

What it does not protect against

Where the key lives

Setting it up

Windows — BitLocker. The device must have TPM 2.0 and secure boot. Save the recovery key, and decide deliberately whether to also require a PIN.

macOS — FileVault. Enable from System Settings; the recovery key is escrowed to an Apple account only if you choose that.

Linux — LUKS. Straightforward and fully under your control:

# Encrypt a new partition during installation, or afterwards
cryptsetup luksFormat --type luks2 /dev/nvme0n1p3
cryptsetup open /dev/nvme0n1p3 luks_crypt
mkfs.ext4 /dev/mapper/luks_crypt

With a header and keyfile for a machine you manage yourself:

# 1. Create the encrypted container
cryptsetup luksFormat --type luks2 --cipher aes-xts-plain64 --key-size 512 /dev/sdb1

# 2. Back up the header. If this volume's header is lost, the data is unrecoverable.
cryptsetup luksHeaderBackup /dev/sdb1 --header-backup-file luks-header-backup.bin

# 3. Create and open it
cryptsetup open --type luks2 /dev/sdb1 crypt_archive
mkfs.xfs /dev/mapper/crypt_archive

A very large LUKS2 header with additional integrity protection is worth considering for long-lived archives:

cryptsetup luksFormat --type luks2 \
  --integrity hmac-sha256 \
  --key-size 512 \
  --cipher aes-xts-plain64 \
  /dev/sdb1

Do not forget

1. Store the recovery key in a password manager and, ideally, printed somewhere separate from the device.
2. Store the LUKS header backup separately from the drive it unlocks.
3. Verify the recovery path once: restore from the recovery key, or unlock the header backup on a different machine.
4. If the device is reinstalled, a new encryption setup is not automatically a continuation of the old one. Check what you expect to still be readable.

Sources

• NIST SP 800-111 — storage encryption for end-user devices, including pre-boot authentication and the threat model.
• LUKS specification — the on-disk format, key slots, and integrity options.
• Microsoft: About BitLocker — device requirements and the TPM model.
• Apple: FileVault — the platform description, including what it protects against on a Mac.