How to Protect the Data on Your Hard Drive, from Day One to Disposal

A Windows or macOS password stops someone using your account. It does not stop someone reading your drive. Take the drive out, connect it to another computer, or start the machine from a USB stick, and unencrypted files are often there to browse.

Protecting drive data is really two jobs. While you own the computer, the data needs to be unreadable to anyone who gets hold of the hardware. When you stop using it, the data needs to be removed. This guide covers both, in the order you will meet them.

Why is a login password not enough?

Because it protects the operating system, not the storage. Anyone with physical access can bypass the login by reading the drive directly, unless the drive is encrypted or locked at the hardware level.

Laptops are the obvious risk because they are lost and stolen, but desktops sent for repair, or left in an office over a weekend, are exposed in the same way.

Step 1: How do I encrypt my drive?

Turn on full-disk encryption: Device Encryption or BitLocker on Windows, FileVault on a Mac. It is free on most current computers and has the biggest effect of anything in this guide.

• Windows Home: many laptops support Device Encryption. Look in Settings under Privacy and security (Windows 11) or Update and Security (Windows 10).
• Windows Pro, Enterprise and Education: BitLocker gives more control, including extra internal drives and USB drives, and can require a PIN at start-up.
• Mac: turn on FileVault in System Settings under Privacy and Security. It ties the drive's encryption to your login.

Device Encryption usually backs up the recovery key to your Microsoft account. That is convenient if you are locked out, but it means a copy of the key lives online. BitLocker lets you print or store the key yourself. Whichever you choose, keep the recovery key safe: a firmware update or hardware fault can ask for it.

Step 2: Should I set a drive password?

If your laptop's firmware offers a hard disk password, it adds a useful barrier, because the drive will not unlock until the password is entered at start-up. On most drives it locks access rather than encrypting the data.

Record the password somewhere safe, because forgetting it can lock you out of the drive for good. And remove it before you sell or return the computer, or the next owner cannot use the drive.

Step 3: What is a self-encrypting drive and is it worth it?

A self-encrypting drive encrypts everything in hardware with its own internal key. On its own it unlocks automatically, so it needs an authentication password before it protects anything. Once that is set, the drive stays locked at power-on.

The catch is that a self-encrypting drive stays unlocked until the power is cut. A laptop that is asleep, rather than shut down, may have an unlocked drive. Get into the habit of shutting down fully when travelling. The benefit comes at the end of the drive's life: destroying the internal key can make the data unreadable almost instantly, a technique we explain in When Does Cryptographic Erase Count as Purge?

Step 4: Which everyday habits matter most?

Shut down rather than sleep when the laptop leaves the house, keep the operating system updated, lock the screen when you step away, and keep backups so encryption never becomes the reason you lose your own files.

Encryption protects against theft and loss. It does not protect against malware running while you are logged in, so updates and sensible downloading still matter. Our article on personal cybersecurity habits covers that side.

Step 5: How do I remove the data when I am finished with the computer?

Erase the whole drive with a method that suits it before the computer is sold, donated, recycled or returned. Encryption makes this easier, but it is not a substitute.

• Do not rely on deleting files or a quick format; both leave recoverable data.
• Hard drives can be overwritten; SSDs need a sanitise command designed for flash.
• Remember second drives, external drives and memory cards.
• If the drive was encrypted, you do not need the key to erase it with a bootable tool, because the tool erases rather than reads.

Recovery keys are often stored in online accounts, so an encrypted drive handed over without erasing could still be unlocked by anyone who later gets into that account. A full erase removes that possibility.

How does RedKey USB help at the end of a drive's life?

RedKey USB starts the computer from USB, outside the operating system, and erases each selected disk using the drive's own commands or overwriting, depending on what the disk supports. It covers up to 16 disks on one computer.

The Home edition shows a clear success or error result on screen, which is all most households need before a sale. For a written record, Professional and Ultimate save a PDF report for every erasure. Our guide to encrypted drives explains the extra considerations for business devices.

Frequently asked questions

Does BitLocker slow down my computer?

On modern hardware the effect is usually small enough not to notice in everyday use.

Is an encrypted drive safe to sell without wiping?

No. Recovery keys can be stored in online accounts, so erase the drive fully before it changes hands.

What is the difference between a drive password and encryption?

A drive password locks access at start-up. Encryption makes the stored data unreadable without the key. Encryption is the stronger protection.

Ready to erase your own devices? See RedKey USB Home. Related reading: How to Erase Encrypted Drives Before Disposal and What Is Secure Data Wiping?.