Full disk encryption (FDE) encrypts an entire storage drive, including the operating system, applications and temporary files, so that its data is unreadable without the correct key or password.
How full disk encryption works
FDE operates below the file system: every sector is encrypted when written and decrypted when read, transparently for the user. Modern implementations typically use AES in XTS mode. Well-known tools include:
- BitLocker on Windows;
- FileVault 2 on macOS;
- LUKS/dm-crypt on Linux;
- VeraCrypt, the open-source successor of TrueCrypt;
- self-encrypting drives (SEDs) that encrypt in the drive’s own hardware.
The data encryption key is itself protected by the user’s password, a recovery key or a TPM, which releases it only if the boot chain has not been modified. iPhones and modern Android devices encrypt storage by default.
Why it matters
FDE protects data at rest. A lost or stolen laptop with an encrypted drive does not lead to a data breach, which is why regulators and the GDPR treat encryption as a key safeguard. However, it does not protect a running, unlocked system: malware and remote attackers see decrypted data like any other program. Research such as cold boot attacks (2008) showed that keys can be recovered from RAM shortly after shutdown, and “evil maid” attacks target an unattended device.
Attackers also abuse FDE: some ransomware uses the built-in BitLocker to lock victims out of their own systems, as in the ShrinkLocker case reported by Kaspersky in 2024.
Best practices
- Enable FDE on all laptops and mobile devices.
- Use a pre-boot PIN on sensitive devices and shut down rather than sleep when travelling.
- Store recovery keys securely and centrally, and monitor for unexpected BitLocker changes.
