Why Full-Disk Encryption Matters

If your laptop is stolen, lost, or seized, full-disk encryption (FDE) is the difference between a device loss and a catastrophic data breach.

Without FDE, anyone who physically possesses your device can access all your data by simply removing the hard drive and connecting it to another computer. Your login password only protects the OS — it doesn't encrypt the underlying data.

With FDE, the entire contents of your storage device are encrypted. Without the decryption key (your password, PIN, or hardware key), the data is completely inaccessible — even if the drive is removed from the device.

FDE is especially critical for: • Laptops (frequently lost or stolen) • Phones and tablets (commonly left in taxis, restaurants, airports) • External drives containing sensitive data • Devices used for work with confidential information

Setup Guides

Windows (BitLocker):

  1. Open Settings → Privacy & Security → Device encryption
  2. If "Device encryption" is available, turn it on
  3. For BitLocker (Pro/Enterprise editions): Control Panel → BitLocker Drive Encryption → Turn on BitLocker
  4. Choose password, PIN, or USB key unlock method
  5. Save your recovery key (print it, save to Microsoft account, or store in your ZeroLatch vault)

macOS (FileVault):

  1. System Settings → Privacy & Security → FileVault
  2. Turn on FileVault
  3. Choose recovery method: iCloud account or recovery key
  4. Save the recovery key securely (ZeroLatch vault recommended)

Linux (LUKS):

  1. Most Linux distributions offer FDE during installation
  2. Choose "Encrypt entire disk" during the install process
  3. Set a strong passphrase
  4. Back up the LUKS header: sudo cryptsetup luksHeaderBackup /dev/sda3 --header-backup-file luks-backup.bin
  5. Store the backup and passphrase in your ZeroLatch vault

Management Tips

• Recovery keys are critical: If you forget your FDE password, the recovery key is your only way to access your data. Store it somewhere other than the encrypted device itself. • Use ZeroLatch only as one delayed recovery layer: A delivery can hold a carefully scoped recovery instruction after the supported long-horizon timeline. Do not use it as the only full-disk-encryption key store or as an emergency-release mechanism. • Performance impact: Modern hardware has negligible performance impact from FDE. AES-NI instructions in modern CPUs handle encryption in hardware. • Pre-boot authentication: Some FDE implementations require a PIN or password before the OS loads. This provides the strongest protection but adds a step to your boot process.