What full disk encryption actually protects when a laptop is stolen
Someone grabs your laptop off a cafe table, or it goes missing from checked luggage, or it’s just gone from your bag on the train. The immediate financial hit is annoying but replaceable. What actually keeps people up at night is what’s on the drive: tax documents, saved passwords, years of email, maybe client files you’re contractually obligated to protect. Full disk encryption is the feature everyone points to as the fix. It’s a real fix. But only for a specific slice of that problem. Knowing exactly which slice matters more than the marketing checkbox.
What full disk encryption actually does
Full disk encryption (FDE) encrypts the entire storage volume, not just a folder or a file. Windows calls its version BitLocker, macOS calls it FileVault, Linux distributions typically use LUKS. The mechanism is similar across all three: the operating system generates a strong symmetric key, usually AES-256, that encrypts every block written to disk. That key itself is protected. Sometimes by your login password, sometimes by a PIN. On Windows and Linux it can also be sealed inside a hardware chip called a TPM (Trusted Platform Module). On Apple Silicon Macs, that’s the Secure Enclave.
When the machine is fully powered off, the disk is just ciphertext. Pull the drive out, plug it into another computer, and you get noise. No amount of file-recovery software or forensic imaging tools changes that. There’s no key material sitting anywhere accessible without going through the unlock process. This is the scenario FDE is built for: a powered-down or hibernated laptop in someone else’s hands, with no valid credentials.
The part that actually determines your outcome: what state was it in
Here’s the detail that gets skipped in most “turn on encryption and you’re safe” advice: the protection depends entirely on the power state the laptop was in when it was taken.
A machine that’s fully shut down is the clean case described above. A machine that’s asleep is different. Sleep on modern laptops keeps RAM powered, and the decryption key typically stays resident in memory. In some configurations the machine can resume instantly without asking for your password again. In others it asks for a quick PIN, a much smaller barrier than a full boot-time unlock. A machine that’s simply locked but still logged in, screen off, is worse still. The operating system is fully running, and the drive is already decrypted for as long as the session is active. Someone who can bypass the lock screen, or who catches it before the screen locks at all, is looking at an unlocked, decrypted machine regardless of what encryption technology sits underneath.
This is why the realistic advice is about your habits, not just a settings toggle. Full shutdown, or at minimum hibernation with a pre-boot password prompt, is what makes FDE do its job. Skip that, and the protection shrinks. A laptop that never gets fully shut down between uses is running with a meaningfully smaller version of the protection than the checkbox suggests.
How each platform actually implements it
BitLocker on Windows can bind the encryption key to the TPM alone, to the TPM plus a PIN you enter before Windows boots, or to a password with no TPM at all on machines that lack one. TPM-only mode is the weakest configuration that still counts as “BitLocker enabled.” The machine unlocks and boots without asking you for anything, relying only on the TPM to verify the boot chain hasn’t been tampered with. TPM-plus-PIN closes that gap. It requires something you know before the drive unlocks. If you’re using BitLocker and want it to actually resist a stolen-and-powered-off scenario, check whether a pre-boot PIN is configured, not just whether BitLocker shows as “on” in settings.
FileVault on Mac ties into the Secure Enclave on Apple Silicon and uses your login password as the unlock credential. Apple’s implementation is comparatively hard to misconfigure into a weak state, since there’s no TPM-only equivalent. But the same power-state caveat applies. FileVault protects a shut-down or non-logged-in Mac, not a logged-in one.
LUKS on Linux is the most flexible option, and also the easiest to leave in a weak state. It depends heavily on how the distribution’s installer set it up, and what passphrase you chose. A short or reused passphrase on a LUKS volume is a meaningfully weaker lock than the same setup with a long one. Unlike TPM-backed systems, LUKS keys are commonly derived straight from what you type.
What encryption does not cover
None of these systems protect anything once the machine is unlocked and running normally. That’s where a lot of the real exposure actually lives. If your browser is set to stay logged into email, banking, or cloud storage, a thief with physical access to an unlocked or easily-bypassed machine gets those sessions. Encryption or not. Cloud-synced folders, like a Documents folder mirrored to a cloud drive, exist in decrypted form on that provider’s servers regardless of what’s happening locally. Saved Wi-Fi credentials, password manager sessions left unlocked, and browser autofill data are all reachable the moment someone is sitting at a logged-in desktop.
There’s also a narrower, more technical category worth naming honestly rather than glossing over: cold boot and DMA-based attacks that try to extract encryption keys from RAM shortly after a machine is put to sleep or powered off, before the memory fully decays. These require specialized tooling and physical access within a short window. Modern laptops with memory encryption and lockdown modes have made them considerably harder to pull off than they were a decade ago. They’re real. They show up in the security research literature, not science fiction. But they’re not the threat model of an opportunistic laptop thief. They matter more for people who are specifically and individually targeted, a different risk profile than “my bag got snatched.”
A realistic way to think about the threat
Most laptop theft is opportunistic. The person who takes it wants a device to resell, and the fastest path to that is wiping it, not digging through your files. Full disk encryption earns its keep by making casual access to your data impossible for someone who has no reason to invest serious effort. And it does that well, when the machine is actually shut down. Defeating a nation-state forensics lab was never the bar it had to clear.
The exception is targeted theft: a work laptop taken specifically because of what’s on it, a device stolen from someone doing sensitive reporting or advocacy work, or a targeted burglary rather than a random grab. For that threat model, encryption is necessary but not sufficient. It should sit alongside habits like not leaving sessions logged in indefinitely, using a password manager instead of browser-saved passwords, and knowing what’s actually synced to the cloud in plaintext. No single setting closes every one of these gaps. Encryption included. Anyone telling you otherwise is selling something.
What to actually check
Confirm BitLocker, FileVault, or LUKS is enabled, not just installed or available. On Windows, check whether it’s TPM-only or TPM-plus-PIN, and add the PIN if it’s missing. Set your laptop to require a password immediately on wake, not after a delay. Get in the habit of fully shutting down rather than closing the lid when the laptop won’t be used for a while, especially before travel. Check what’s actually logged in and staying logged in in your browser, since that’s the part encryption was never going to cover.
None of this requires paranoia or exotic tools. It requires knowing which part of the problem the checkbox solves, and handling the rest with ordinary habits.
If you want more explainers like this that stick to what a tool actually does instead of what it’s marketed to do, check out the rest of The Privacy Wire.