3

This is mostly a general question about full disk encryption, but I have bitlocker in mind.

  1. What does it mean when people say full disk encryption? Because I imagined that it literally encrypts the whole physical disk, which requires a pre-boot decryption for it to work. I got confused because when I was about to turn on bitlocker, I had turn it on for each logical partition, C:\, D:\, E:\, instead of the whole disk at once. Does it mean it's not a full disk encryption then?
  2. From a security point of view, is there a difference between full disk encryption and encrypting per partition?
  3. (Terminology question) Is there a difference between full disk encryption and full drive encryption? e.g. disk refers to the physical item and drive the logical partition?
Anders
  • 64,406
  • 24
  • 178
  • 215
  • 3
    Full disk encryption means encryption at the block layer (disk, partition) vs. encryption at the file-system layer (i.e. per file encryption). – Steffen Ullrich Nov 09 '17 at 16:07

1 Answers1

2
  1. to me, "full" means "all of it". I believe that BitLocker uses TPM on your device to encrypt the drive/partitions. If you don't have all logical partitions encrypted, then to me the entire disk is not protected.
  2. Encryption is encryption in a case where TPM is used to decrypt or access the disk/partition. I'd suggest encrypting the whole thing - if there's any data you don't want lost/compromised in the event of theft, encrypting it with TPM is the way to go. You might take a small performance hit with making partitions accessible vs the whole drive, but that happens during the boot sequence. Ideally you'd use a means of encrypting a volume that requires a preboot sequence/authorization - that will make the casual bad guy work harder than using encryption not requiring preboot authentication.
  3. To me, the disk is the physical volume. The drive is either the partition or mount point or remote storage and is a logical volume. ie you have one hard drive, which is a disk and you partition it into volumes and label those c: and d: (or whatever). In that case, full disk encryption would encrypt the physical disk and full drive encryption would encrypt the logical volume.
baldPrussian
  • 2,768
  • 2
  • 9
  • 14