What does full disk encryption protect against?

Full disk encryption protects against unauthorized access to data on a device that has been lost, stolen, or physically seized. Without FDE, removing the drive and connecting it to another computer gives an attacker immediate access to all files. With FDE enabled, the drive is unreadable without the correct key. FDE does not protect a running, unlocked device from software attacks or a logged-in insider.

Does full disk encryption slow down my computer?

On modern hardware, the performance impact is negligible. Intel and AMD CPUs manufactured since 2010 include AES hardware acceleration (AES-NI). BitLocker and FileVault both use AES-XTS, which runs at near-memory-speed on AES-NI hardware. Apple Silicon Macs with the Secure Enclave encrypt and decrypt transparently with no measurable overhead.

What happens if I forget my BitLocker recovery key?

Without the BitLocker recovery key, the encrypted drive is unrecoverable — that is precisely the point. For personal devices, Microsoft recommends storing the key in your Microsoft account or printing it. For business devices, IT administrators should escrow recovery keys to Azure Active Directory or Microsoft Intune before deploying BitLocker.

Is FileVault the same as full disk encryption?

Yes. FileVault is Apple's implementation of full disk encryption for macOS. On Apple Silicon and T2-chip Macs, the Secure Enclave handles key management in dedicated hardware. FileVault adds the pre-boot authentication layer on top of always-on hardware encryption. Enabling FileVault is the correct action on any Mac containing sensitive data.

Do I need full disk encryption if I have a strong password?

Yes. A login password only prevents access through the operating system's login screen. If someone removes your drive and connects it to another machine, they bypass the OS entirely and read your files directly. Full disk encryption protects the underlying data regardless of how the drive is accessed, including by direct hardware access.

Is BitLocker FIPS compliant?

BitLocker's cryptographic modules have achieved FIPS 140-2 validation. For federal government use, FIPS mode must be enabled in Windows Group Policy before enabling BitLocker — this forces the operating system to use only FIPS-validated cryptographic modules. Apple's Secure Enclave has achieved FIPS 140-3 Level 2 validation for its relevant components.

Full Disk Encryption: BitLocker and FileVault Explained

Introduction

One lost laptop should not become a data breach. Without full disk encryption, it always does — every file, every credential, every browser cookie becomes accessible to whoever finds the drive.

Full disk encryption protects every sector of your storage device: operating system files, user documents, temporary files, swap space, and even the empty space where deleted files once lived. Remove the drive, plug it into another computer, and all of it is unreadable without the encryption key. The data is there — it is just indistinguishable from random noise.

According to IBM Security and Verizon’s Data Breach Investigations Report, 68% of data breaches involve a lost or stolen device as the initial access vector. For most of those breaches, the exposure was entirely preventable. Full disk encryption is the single control that turns a lost laptop from a data breach notification into an inconvenient insurance claim.

GDPR Article 34 codifies this directly: if personal data was encrypted and the encryption key was not compromised, organizations are typically exempt from notifying affected individuals after a breach. HIPAA and PCI-DSS treat FDE similarly. The regulatory safe harbor exists because strong FDE makes the stolen data genuinely useless to an attacker.

Both Windows and macOS ship with full disk encryption built in. BitLocker on Windows and FileVault on macOS are mature, FIPS-validated implementations backed by dedicated hardware security chips. The only question is whether you have turned them on.

What Is Full Disk Encryption?

Full disk encryption (FDE) is a security technology that encrypts every sector of a storage device using a symmetric encryption key. The operating system, applications, user files, logs, and temp files are all encrypted. The device boots and operates normally when the correct credentials are provided; without them, the storage medium contains only encrypted data.

FDE is distinct from file-level encryption, which encrypts individual files or folders. File-level encryption leaves metadata (file names, sizes, directory structure) readable and misses temporary files, swap space, and OS components. FDE encrypts everything, including data that never appears as a named file.

The encryption happens transparently at the storage layer using a symmetric encryption key like AES. When you write a file, the encryption engine encrypts it before it reaches the disk. When you read, the engine decrypts on the fly. From the OS and applications perspective, the drive behaves normally.

How Full Disk Encryption Works

BitLocker (Windows)

BitLocker uses AES-128 or AES-256 in XTS mode. XTS-AES (XEX-based Tweakable-cipher Encryption with ciphertext Stealing) is designed specifically for disk encryption. Different sectors get different tweak values derived from their position on the disk, preventing an attacker from detecting that two sectors contain identical data.

BitLocker uses a key hierarchy with two levels:

The Full Volume Encryption Key (FVEK) encrypts individual disk sectors directly.
The Volume Master Key (VMK) wraps the FVEK. Protecting the VMK is where the security lives.

The VMK is sealed by the TPM (Trusted Platform Module) — a dedicated security chip on the motherboard. The TPM measures the boot chain: BIOS firmware, bootloader, and early OS components. If any measurement changes — a BIOS update, a tampered bootloader, a boot sector modified by malware — the TPM refuses to release the VMK, and the drive remains encrypted.

A recovery key (a 48-digit number) unlocks the drive when the TPM refuses. This key must be stored outside the encrypted device.

FileVault (macOS)

FileVault also uses AES-128 or AES-256 in XTS mode. On Apple Silicon Macs and those with a T2 chip, a dedicated Secure Enclave processor handles key management. The Secure Enclave is a separate system-on-chip with its own secure memory — it is architecturally isolated from the main processor.

The Secure Enclave plays the same role the TPM does for BitLocker: it holds key material that only it can access, seals that material to the device, and releases it only when valid user credentials are presented. On Apple Silicon, hardware-based FDE is always on; FileVault adds the pre-boot authentication layer that requires a user password before the Secure Enclave releases the volume key.

FileVault generates a 24-character alphanumeric recovery key at setup. Every authorized user account can unlock the volume with their login password.

This video introduces how full disk encryption works at a conceptual level. The sections above extend this to the specific BitLocker and FileVault implementations, including the TPM and Secure Enclave key management roles.

Follow the key hierarchy downward — the TPM (BitLocker) or Secure Enclave (FileVault) seals the Volume Master Key, which wraps the Full Volume Encryption Key that directly protects disk sectors.

BitLocker vs FileVault

Feature	BitLocker (Windows)	FileVault (macOS)
Algorithm	AES-128/256-XTS	AES-128/256-XTS
Hardware root of trust	TPM 2.0	Secure Enclave (T2/M-series)
Pre-boot authentication	PIN, USB key, or TPM-only	Login password
Recovery key length	48 digits	24 alphanumeric characters
Enterprise management	Active Directory / Intune	Jamf / MDM
FIPS validation	FIPS 140-2 (modules validated)	Secure Enclave: FIPS 140-3 Level 2
OS versions	Windows 10/11 Pro, Enterprise, Education	macOS 10.15 Catalina and later

Both use the same underlying cipher (AES-XTS). The key difference is in the hardware root of trust and enterprise management integrations. TPM is a standards-based chip (TCG TPM 2.0) present in most business-grade PCs. The Secure Enclave is Apple-proprietary but deeply integrated into Apple Silicon. For enterprises managing both platforms, Microsoft Intune and Jamf Pro both support FDE management and recovery key escrow.

Real-World Use Cases

Remote work laptops: A consultant with a laptop full of client files loses it at an airport. Without FDE, the finder has immediate access to every document. With BitLocker enabled and the recovery key escrowed to the company’s Azure AD, the IT team can remotely verify the device is encrypted and confirm the data is protected — no breach notification required under GDPR Article 34.

Healthcare devices: Laptops used by healthcare workers to access patient records must meet HIPAA’s physical safeguard requirements. Full disk encryption is the standard technical control for portable devices. A hospital that enables FileVault on every clinician MacBook ensures a stolen device does not trigger a HIPAA breach notification.

Developer workstations: Developer laptops contain source code, SSH private keys, API credentials, and database passwords. A stolen developer laptop without FDE gives an attacker direct access to cloud accounts, CI/CD pipelines, and production databases. BitLocker or FileVault is the minimum baseline for any developer machine handling production access.

Common Mistakes to Avoid

Enabling FDE without escrowing the recovery key. A device that boots up prompting for a recovery key — and no one knows where it is — is as lost as a stolen device. For business use, always configure recovery key escrow before deploying FDE. For personal use, save the key to your Microsoft account (BitLocker) or store the FileVault key in iCloud. Print a copy and store it physically separate from the device.

Relying on FDE for a running, unlocked device. FDE protects data at rest — a powered-off or locked device. It does not protect against a logged-in insider threat, malware on a running system, or an attacker who has physical access to a device you left unlocked. Screen lock timeouts, strong login passwords, and endpoint detection complement FDE but do not overlap with it.

Skipping the recovery key test. Enable FDE, generate a recovery key, and then actually test it on a non-critical device before relying on it organizationally. Recovery keys that were never tested occasionally fail due to OCR errors in printed copies or sync issues with cloud storage. Test once before you need it.

Not applying FDE to external drives and backups. Encrypting the laptop’s internal drive while backing up to an unencrypted external drive or NAS creates an obvious gap. BitLocker can encrypt removable drives (BitLocker To Go). FileVault does not extend to external drives, but macOS Disk Utility can create encrypted volumes on external drives using the same AES-XTS cipher.

Getting Started

Check your current FDE status before assuming it is enabled. On Windows 10/11 Pro, search for “Manage BitLocker” in the Start menu — the status shows “BitLocker On” or “BitLocker Off” for each drive. On macOS, go to System Settings → Privacy & Security → FileVault. The status is clearly shown as “On” or “Off.”

If FDE is off, enabling it is a straightforward process. BitLocker prompts you to save the recovery key (choose Azure AD if you have a work account, Microsoft account for personal use, or USB). FileVault asks where to store the recovery key (iCloud or a printed local key). Encryption happens in the background while you work — it does not require downtime.

For organizations rolling out FDE at scale, use Microsoft Intune (Windows) or Jamf Pro (macOS) to enforce FDE policy, escrow recovery keys centrally, and generate compliance reports. Both tools can verify that FDE is enabled and the encryption key is properly escrowed before marking a device as compliant.

After enabling FDE, understand what it does and does not cover. It is one layer in a defense-in-depth stack. To understand the regulatory implications of FDE for lost devices under European law, read GDPR encryption requirements and the lost-device safe harbor. For enterprise environments requiring hardware-backed key management beyond TPM, see hardware security modules explained. For a deeper look at the TPM chip that underpins BitLocker’s security model — including how sealed storage and remote attestation work — see What Is a Trusted Platform Module (TPM).