Windows Security · BitLocker & Encryption · Lesson 1 of 5

Is Your Drive Encrypted?

Check if your drive is locked, and learn what that lock really stops.

Checking the lock on your drive

Encryption scrambles data so it looks like nonsense. Only someone with the right key, a long secret code, can turn it back into readable files.

Your drive is the part of the computer that stores everything: Windows, your apps, your photos and your documents. When the whole drive is encrypted, a thief can't simply pull it out and read it on another computer.

Windows has two versions of this lock.

• Device encryption works on many computers, including ones running Windows 11 Home. It has almost no settings. It is simply on or off.
• BitLocker is the full version. It comes with Windows 11 Pro, Enterprise and Education. It adds more choices, like a PIN before Windows starts and locks for extra drives.

Both use the same BitLocker technology underneath. Both keep the key safe in the TPM, the security chip you met earlier. That's why the drive unlocks by itself when Windows starts normally.

On many computers, device encryption turns on by itself when you sign in with a Microsoft account or a work or school account. With a local account, it may stay off. So don't guess. Check.

1. Open Settings.
2. Choose Privacy & security, then Device encryption.
3. Look at the switch. On means your drive is encrypted.

On Pro, you can also search the Start menu for Manage BitLocker. If you can't find the setting at all, your computer may not support it, or you may be signed in as a standard user.

On a Mac, the same lock is called FileVault, in System Settings > Privacy & Security.

On the practice computer, check that encryption is on and find where the recovery key is backed up. Save a second copy, then type the key into the blue recovery screen to unlock it.

What drive encryption can't stop

Drive encryption protects your data at rest. That means while it sits stored on the drive, with the computer turned off or not yet signed in.

Here is the case it was built for. Your laptop is stolen from a car. The thief can't sign in, so they take out the drive and plug it into another computer. Without encryption, every file would be readable. With encryption, they only get scrambled nonsense.

It also protects you when a laptop is lost, sold or sent for recycling. And it blocks a trick where someone starts your laptop from a USB stick to copy files around Windows.

Now the limit. Once you sign in, Windows unlocks the drive so you can work. Your files become readable to you, and to anything running as you.

So drive encryption does not stop:

• Malware, harmful software, that runs while you're signed in. It can see your files just like you can.
• A scammer you let in with remote access software.
• Someone who walks up to your laptop while it's unlocked.
• A fake sign-in page that tricks you into typing your password.

That's why encryption is one layer, not the whole wall. It works best alongside the layers you already know: a standard account for daily use, a Windows Hello PIN, regular updates and good backups.

One small habit makes it much stronger. Lock the screen when you step away by pressing Windows+L. A locked laptop still needs your PIN or password before anyone sees a file.