Festplattenverschlüsselung

A lost laptop is annoying. A lost laptop with an unencrypted hard drive can be a reportable data breach. Hard drive encryption protects data as long as the device is switched off or locked. It is helpful for decommissioning, but does not replace erasure.

How hard drive encryption works

All data is encrypted with a symmetric key, usually using the AES method. This data key is itself protected once more, for example by a password, a PIN or a chip in the device, the TPM (Trusted Platform Module). At startup the system unlocks the key; after that, data is automatically encrypted and decrypted during reading and writing. Users barely notice this.

Variant	Examples	Special feature
Software in the operating system	BitLocker (Windows), FileVault (macOS), LUKS (Linux)	Centrally manageable, recovery key required
Hardware in the drive	Self-encrypting drive (SED), TCG Opal	Encryption by the drive controller
Mobile devices	Device encryption on current smartphones and tablets	Active by default, tied to the device lock

Limits of encryption

• Only effective when locked: If the device is unlocked, the data is readable by anyone who accesses it.
• Key and password: A weak password or a recovery key stored with the device cancels out the protection.
• Not active from the start: If encryption is applied later and only the used storage is covered, old data may remain unencrypted in the free area.
• No proof: Encryption does not prove that the data was ultimately removed.

Hard drive encryption when decommissioning

Encrypted data carriers are better protected on the way to the service provider. In addition, they enable Crypto Erase: If the key is destroyed, the data can no longer be read. For proof to auditors and supervisory authorities, you still need an erasure report per data carrier. Clarify beforehand whether devices must be decrypted before handover or whether recovery keys are needed, so that erasure and refurbishment run smoothly. Which methods suit HDDs and SSDs is explained in the guide Securely erasing hard drives and SSDs.

Hard drive encryption at Second IT

Second IT erases every data carrier software-based with Blancco and documents this with a digitally signed erasure certificate per device. Data carriers that cannot be erased are destroyed in-house in accordance with DIN 66399 (up to security level H-5 and E-5). More on the certified data deletion and in the article Data protection for hard drives.

Frequently asked questions about hard drive encryption

Is an encrypted hard drive sufficient as a data protection measure for disposal?

It significantly reduces the risk but does not replace proof. For accountability you need an erasure or destruction certificate per data carrier. Encryption and erasure complement each other.

Do I have to disable BitLocker before handing over the devices?

This is not mandatory for erasure, because secure erasure methods work below the operating system. For diagnostics and refurbishment it can be helpful, though. Coordinate the procedure with your service provider.

Does hard drive encryption slow down the computer?

On current devices it is barely noticeable. Modern processors accelerate AES in hardware, and self-encrypting drives do the work in the controller.

What is the difference between BitLocker and FileVault?

BitLocker is the hard drive encryption of Windows, FileVault that of macOS. Both encrypt the entire data carrier with a key. For Linux there is LUKS. With every system, it is important that the recovery key is stored securely.

What is a recovery key in hard drive encryption?

It is a backup key in case the password or PIN is no longer available. Store it separately from the device. If it is kept together with the device, it cancels out the protection of the encryption.