FDE (full-disk encryption) turns the contents of a disk into ciphertext. Without the password or the key, a read of a powered-off drive returns garbage, not files.
That is the right answer to a lost laptop, a drive handed to a repair shop, and a machine you are about to sell. An unlocked session is a different problem: after you type the password, the system reads the volume normally. Malware, a screenshot, and a cloud copy sit beside the encryption.
VeraCrypt is the open successor to TrueCrypt. It runs on Windows, Linux, and macOS. It encrypts a system partition, or it keeps data in a container — a file you mount as a drive. Project site: veracrypt.jp. Mirror: veracrypt.io. Take the installer from one of those two, not from a “free software” catalog.
Set this once and test it the same day:
- A password you can type when you are tired. A long sentence you remember beats a short string of symbols you cannot reproduce.
- Keep the Rescue Disk and the password off this laptop: a note in a drawer, or a password manager on another device. The only copy of the password in the same bag as the laptop is not a copy.
- After install, confirm the system boots from the password and that the Rescue Disk mounts. The day of the theft is too late for that test.
Windows Pro also has BitLocker. It fits when you stay on the Microsoft stack and the recovery key lives off the machine: an account, a printout, another disk. Use VeraCrypt when the same lock has to work on Linux, on Windows Home, or without tying the key to a TPM.
Disk encryption does not replace a backup. The backup should be encrypted too. Otherwise FDE locks the laptop and the backup stick sits in the open.