Computer encryption

1. What does encrypting a computer mean?

Encrypting a computer means protecting the information stored on its disk so that other people cannot read it without the corresponding password or key. If you lose your computer or it is stolen, encryption helps prevent access to your files.

2. Before you start

• Back up your important files.
• Use a strong password. You can generate and store it with a password manager such as KeePassXC.
• Where applicable, store the recovery key in a safe place, separate from the computer.
• Plug the computer in: the first encryption can take several hours.

3. Encrypting a Windows computer

Option A: Device encryption (Windows 11)

It may be available even on Windows 11 Home, as long as the computer meets the requirements.

1. Open Start → Settings.
2. Go to Privacy & security → Device encryption.
3. If the option appears, turn it on.
4. Wait for the process to finish.
5. Check that it is turned on and that you can access the recovery key.

Option B: BitLocker (Windows 10 and 11 Pro, Enterprise and Education)

1. Open Start and search for Manage BitLocker.
2. Select the system drive, usually C:.
3. Click Turn on BitLocker.
4. Follow the instructions and save the recovery key. You can print it or save it to a file or USB drive that is not on the same computer.
5. Select Encrypt entire drive if the computer has already been used.
6. Start the encryption and wait for it to finish.

To check the status, open Command Prompt as administrator and run manage-bde -status: the drive should show Protection On.

Option C: VeraCrypt (free and open source)

VeraCrypt can encrypt the system on compatible computers, even with Windows Home. Official site: veracrypt.io.

1. Download and install VeraCrypt from its official site.
2. Open the program and select System → Encrypt System Partition/Drive.
3. Select Normal and follow the wizard.
4. Choose a strong password.
5. Create and save the requested rescue disk.
6. Run the boot test (Pretest): the computer will restart and ask for your password.
7. If the test works, start the encryption and wait for it to finish.

4. Encrypting a Mac (macOS)

Tool: FileVault, built into macOS.

1. Click the Apple menu.
2. Open System Settings → Privacy & Security.
3. Find FileVault and click Turn On FileVault.
4. Enter your user password if prompted.
5. Choose the recovery method: through your iCloud account or with a recovery key that you will need to store.
6. Confirm and wait for the encryption to finish.
7. Check on the same screen that FileVault shows as turned on.

5. Encrypting a Linux computer

Usual tool: LUKS. In many distributions, it is easiest to turn on encryption while installing the system.

1. Start the Linux installer from a USB drive.
2. Continue until you reach the disk setup.
3. Look for Encrypt disk, Use LVM and encryption or LUKS encryption (the name varies).
4. Turn on encryption and enter a strong password.
5. Save any recovery key offered.
6. Continue the installation and, when you turn on the computer, enter the encryption password when prompted.

Check whether Linux is already encrypted

1. Open a terminal and run lsblk -f.
2. Look for a partition of type crypto_LUKS and confirm that it corresponds to the system or the data you want to protect.

6. Recommendations after encrypting

• Shut down the computer when traveling or when there is a risk of theft or confiscation (sleep mode is not enough).
• Set up automatic screen lock.
• Do not share your password or recovery key.
• Keep the operating system up to date.
• Make regular backups and protect them too.
• In organizations, agree on how to safeguard recovery keys.