In short
Full disk encryption (FDE) encrypts everything on a device's drive, so data cannot be read if the device is lost or stolen without the key or the user's credentials. On business devices it normally uses the built-in engines, BitLocker on Windows and FileVault on macOS, managed centrally to enforce encryption, escrow recovery keys and report which devices are protected.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What full disk encryption is
Full disk encryption encrypts the whole storage drive of a device: the operating system, applications, temporary files and user data. When the device is switched off, everything on the drive is unreadable. When an authorised user starts the device and signs in, or passes a pre-boot check such as a PIN, the drive is unlocked and works as normal.
Because encryption covers the whole drive, it does not depend on users saving files in the right place. That is what makes it the standard control for laptops and other portable devices, and why "endpoint encryption" in most organisations means full disk encryption plus encryption of removable media.
Windows and macOS both include strong full disk encryption: BitLocker on Windows Pro, Enterprise and Education editions, and FileVault on macOS. Most business encryption products today manage these built-in engines rather than replacing them, which keeps them compatible with operating system updates and avoids a second encryption layer to maintain.
What full disk encryption protects, and what it does not
It is worth being clear about the threat FDE addresses, because it is often oversold.
| Scenario | Does FDE help? | Why |
|---|---|---|
| Laptop lost or stolen while switched off | Yes | The drive cannot be read without the key or the user's credentials |
| Drive removed and read in another machine | Yes | The data on the drive is encrypted |
| Old device disposed of or returned | Yes | Crypto-erasing or keeping the drive encrypted reduces the risk of recovered data |
| Device stolen while unlocked or asleep | Partly | Data is accessible while the drive is unlocked; pre-boot authentication and short lock times help |
| Phishing or stolen passwords | No | The attacker uses the device or account as the real user would |
| Malware or ransomware on a running device | No | Data is decrypted for anything running as the user; this needs EDR and ransomware prevention |
| Files sent by email or copied to cloud storage | No | Encryption stays with the disk, not the file |
FDE is one layer. It sits alongside endpoint protection, patching and the other controls in our endpoint security best practices guide.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
Full disk encryption vs file-based encryption
File-based encryption protects individual files or folders, and the protection can travel with the file. The two approaches answer different questions and many organisations use both.
| Full disk encryption | File-based encryption | |
|---|---|---|
| What is encrypted | The whole drive, including system and temporary files | Selected files or folders |
| Protects against | Lost or stolen devices and removed drives | Unauthorised access to specific files, including when shared |
| When data is readable | While the device is unlocked | Only to users or apps with access to that file's key |
| Depends on users | No: the whole drive is covered | Often, if users choose what to encrypt |
| Typical tools | BitLocker, FileVault, managed from a security or device management console | Document and email protection, encrypted containers, information protection labels |
| Best for | Laptops, desktops and servers in less secure locations | Sensitive documents that are shared or stored outside the device |
Phones and tablets are handled differently again: current iOS, iPadOS and Android devices encrypt their storage, and the protection relies on a strong passcode. Your mobile device management policy is what enforces that passcode.
Removable media encryption
USB drives are small, easily lost and often forgotten. If staff need them at all, they should be encrypted. BitLocker To Go encrypts removable drives on Windows, and several endpoint suites can require encryption before data is written to a USB device or block unencrypted media altogether.
Check Point Harmony Endpoint Complete, for example, combines full disk encryption with removable media encryption in one console. Many organisations go further and restrict USB storage entirely, allowing only approved encrypted devices; see USB device control for how allow, read-only and block policies work.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
What to look for in full disk encryption software
Because the encryption engine is usually BitLocker or FileVault, the differences between full disk encryption solutions are in management:
- Policy-based enforcement: encryption is applied automatically to every device in a group, not switched on by hand.
- Recovery key escrow: recovery keys are stored centrally and securely, so a locked-out user can be helped and a departed user's device can be recovered.
- Pre-boot authentication options: TPM only, TPM plus PIN or other methods, chosen per device group.
- Encryption status reporting: a list of which devices are encrypted, which are not and why, ready for audits, insurers and customer questionnaires.
- One console: encryption managed alongside endpoint protection, EDR and patching, so a device's whole security state is in one place.
- Removable media: optional encryption of USB drives, or integration with device control.
Our BitLocker management guide goes into recovery keys, PINs and reporting in more detail.
Encryption, UK GDPR and audits
UK GDPR requires appropriate technical and organisational measures to protect personal data, and Article 32 names encryption of personal data as one example. Encryption does not make you compliant on its own, but if an encrypted laptop is lost and the key has not been compromised, the risk to the people whose data it holds is much lower.
Evidence matters as much as the control. When an insurer, auditor or customer asks whether laptops are encrypted, a central report answers the question in minutes. On Windows, the NCSC's guidance recommends BitLocker configured to require a PIN (see our NCSC device security guidance summary and BitLocker management guide), and our endpoint security compliance guide maps encryption to other UK frameworks.
Full disk encryption solutions we supply
We supply several ways to manage disk encryption centrally, so we can match the tool to the endpoint platform you already run.
| Solution | What it manages | Notes |
|---|---|---|
| Bitdefender GravityZone Full Disk Encryption | BitLocker on Windows and FileVault on macOS | Policy-based encryption, central recovery keys and reports; Bitdefender states no extra agent or key server is needed |
| WatchGuard Full Encryption | BitLocker on Windows | Optional module for every WatchGuard Endpoint Security edition, with pre-boot authentication and central key recovery; see WatchGuard Endpoint Security 360 (formerly EPDR) |
| Sophos Device Encryption | BitLocker and FileVault | Formerly Sophos Central Device Encryption; see Sophos Device Encryption |
| Check Point Harmony Endpoint Complete | Full disk encryption with pre-boot authentication or managed BitLocker and FileVault, plus removable media encryption | See Harmony Endpoint Complete |
If you already manage devices with Microsoft Intune, it can also enforce BitLocker and FileVault; see Microsoft Intune from Forever Group. Prices depend on device numbers and the platform you choose, so ask us for a quote.
How we help
We start by finding out where you are: which devices are already encrypted, where their recovery keys are (often nobody is sure), which Windows editions you run and which endpoint platform you use. From there we can:
- Recommend a way to manage encryption that fits your existing endpoint or device management tools
- Help plan how existing encryption is brought under central management without users losing access
- Help set pre-boot authentication and recovery processes that suit your users
- Set up reports you can hand to auditors and insurers
- Arrange licensing, with pricing confirmed at quote
Contact us to talk through full disk encryption for your devices.
Encryption guides
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What is full disk encryption?
Full disk encryption encrypts the entire storage drive of a device, including the operating system and user files, so the data cannot be read if the device is lost or stolen without the key or the user's credentials. On business devices it usually means BitLocker on Windows and FileVault on macOS, managed centrally.
Is BitLocker full disk encryption?
Yes. BitLocker is the full disk encryption built into Windows Pro, Enterprise and Education. It can also encrypt removable drives through BitLocker To Go. Most business encryption products manage BitLocker rather than replacing it.
Does full disk encryption protect against ransomware?
No. Full disk encryption protects data on a device that is switched off or locked. Ransomware runs on a working, unlocked device, where data is already decrypted. Protection against ransomware needs EDR, patching, backups and the other controls in our ransomware guide.
What is the difference between full disk encryption and file encryption?
Full disk encryption protects everything on a drive while the device is off or locked. File-based encryption protects chosen files or folders and can stay with a file when it is shared. Many organisations use full disk encryption on every device and file-based protection for sensitive documents.
Is full disk encryption required for UK GDPR?
UK GDPR does not name a specific product, but Article 32 lists encryption of personal data as an example of an appropriate security measure. Encrypting laptops and keeping a report of which devices are encrypted is a common way to show you have taken appropriate measures.
Still have a question about full disk encryption?
Ask us and a member of our team will reply by email.