What is full-disk encryption?
Full-disk encryption protects data at rest. The whole volume is stored as ciphertext. After the device is unlocked at startup, the operating system decrypts data as it is read and encrypts it as it is written, so users notice little difference. Because everything is covered, including system files, applications, the page file and temporary files, sensitive data does not leak into unencrypted corners of the drive. If a laptop is stolen and the thief removes the drive or boots another operating system, all they see is unreadable data.
Common FDE tools
| Platform | Tool | Notes |
|---|---|---|
| Windows Pro, Enterprise, Education | BitLocker | Encrypts OS and fixed data drives; BitLocker To Go covers removable drives; manage-bde -status shows the state |
| Windows Home | Device encryption | A simplified BitLocker-based mode on supported hardware; the recovery key is saved to the Microsoft account |
| macOS | FileVault | Turned on in System Settings > Privacy & Security; fdesetup status shows the state |
| Linux | LUKS (Linux Unified Key Setup) | Managed with cryptsetup; often enabled during installation |
These tools use AES (Advanced Encryption Standard). Current iPhones and Android phones encrypt their storage by default, and the device passcode is what protects those keys.
Keys, the TPM and recovery
- TPM (Trusted Platform Module): a security chip that protects the encryption key and releases it only if the startup components have not been changed. With TPM-only mode, the drive unlocks automatically during a normal boot.
- Pre-boot authentication: BitLocker can require a PIN at startup (TPM + PIN), which adds protection if the laptop itself is stolen. Systems without a usable TPM can use a password or a USB startup key instead.
- Recovery key: BitLocker's recovery key is a 48-digit number. It is needed after events such as firmware updates, a TPM reset, a motherboard replacement, moving the drive to another PC or a forgotten PIN. Store it in a Microsoft account, in Active Directory or Microsoft Entra ID for company devices, or on paper in a locked place. Never keep it only on the encrypted drive.
What FDE does not protect
- Once the device is unlocked and a user signs in, files are readable by that user and by any malware running as that user.
- Data copied elsewhere, such as email, cloud storage or an unencrypted USB drive, is not covered.
- A running or sleeping device keeps its keys in memory; protection is strongest when the device is shut down or hibernated.
- It does not replace a screen lock, strong sign-in, patching or backups.
Full-disk vs. file-level encryption
| Feature | Full-disk encryption (BitLocker, FileVault) | File-level encryption (EFS) |
|---|---|---|
| Scope | Entire volume | Selected files and folders on NTFS |
| Main threat covered | Lost or stolen device, removed drive | Other users on the same computer |
| Unlocked by | TPM, PIN or password at startup | The user's sign-in and EFS certificate |
| Main risk | Losing the recovery key | Losing the user's certificate and private key |
Encryption also helps at disposal time: destroying the key (crypto-erase) leaves the stored data unreadable, although many policies still require a verified wipe or physical destruction.
Full-disk encryption on the CompTIA A+ exam
FDE spans Core 2 (220-1202) objective 2.2, which covers Windows security settings such as BitLocker, BitLocker To Go and EFS, and objective 2.7, which covers workstation hardening, including data-at-rest encryption. If a scenario says a laptop might be lost or stolen and the data must stay private, choose full-disk encryption (BitLocker on Windows, FileVault on a Mac). If only one folder needs protection from other users on a shared PC, choose EFS. If the data travels on a USB flash drive, choose BitLocker To Go. If BitLocker asks for a recovery key after a motherboard replacement, retrieve the key from where it was escrowed. If BitLocker is missing, check the Windows edition.