For planned protection of your own authorised data
Use genuine supported tools and the owner’s policy for work/shared information. An already locked device or unexpected ransomware needs recovery/incident help before any new encryption changes.
Step 1 of 9
Choose what needs protection
Choose what needs protection
Decide whether you need to protect data on a lost/stolen computer, a removable drive or a particular document sent to someone else. Note where copies exist and who must still be able to open them. Work/shared information needs the responsible owner’s approved method before changing protection or recovery arrangements.
Device/drive encryption helps protect stored data against access without the appropriate unlock credentials. It does not replace backups, safe sign-in or protection from malware running in an authorised unlocked session. A file copied out or shared from the device may need its own appropriate protection.
If ransomware has unexpectedly encrypted files, that is a separate incident, not a reason to add another encryption layer. Follow ransomware first steps. For planned protection on a stable device, check existing status and recovery before enabling or changing anything.
Choose the actual data, loss/sharing scenario and authorised readers. Encryption, account security and backup address different needs; unexpected ransomware follows incident response.
Check existing status and device support
Check existing status and device support
On your own stable device, inspect the genuine system’s encryption status without turning protection off. Record the relevant drive/device, feature and whether it is on, waiting, in progress or managed. Do not infer status just from a padlock picture or the presence of a Windows login password.
Windows Device Encryption can be available on eligible devices including some Home systems; the separate manual BitLocker controls depend on edition. Hardware/account/setup affect availability and automatic activation. Check the actual screen rather than assume every Windows computer has identical controls.
On a Mac with Apple silicon or an Apple T2 chip, Apple describes automatic hardware data encryption with FileVault adding protection tied to login/recovery. FileVault off is not a universal statement that all such hardware stores plain unencrypted data. Use the actual Mac model/version and management policy. If a setting is unavailable or controlled by an organisation, ask its owner rather than alter firmware or remove management.
Read the actual feature, drive, support and management state. Do not disable existing protection or change firmware merely to make a generic instruction fit.
Next: Prepare backup and a separate recovery routePrepare backup and a separate recovery route
Prepare backup and a separate recovery route
Before starting or changing encryption, have an appropriate usable backup and confirm how it can be restored. Keep required backup passwords/keys privately as well. A copy accessible only through the same locked device may not provide the recovery route you expect.
For device encryption, identify where the matching recovery information is held: your own genuine account, an approved independent record or the responsible organisation’s recovery process. Ensure it is available without relying solely on the encrypted drive. Do not store the only key as a file on that same drive or attach a printed secret to the laptop.
Microsoft’s BitLocker recovery guidance uses a key ID to identify the matching key and explains personal versus organisation-held records. Keep the key itself secret; do not paste it into a public enquiry or screenshot. If the device is already locked or the recovery route is uncertain, stop and seek appropriate help before new protection, reset or firmware changes.
Confirm a usable backup and matching recovery route independent of the protected drive. Keep secrets private; uncertain keys or an already locked device need assessment before changes.
More checks6 detailed checks
Use the supported Windows encryption controls
Use the supported Windows encryption controls
For an eligible personal setup, open Settings, Privacy & security, Device encryption and inspect the actual supported options. If protection is already active with a confirmed recovery route, do not toggle it off/on as a test. If it is not available, check the supported device/edition/account guidance or ask for help; do not clear the TPM or change Secure Boot to force eligibility.
On appropriate Pro, Enterprise or Education systems, Microsoft’s manual BitLocker guidance starts with Manage BitLocker. Identify the intended operating-system, fixed-data or removable drive, choose its supported Turn on BitLocker operation, and complete the unlock/recovery-key choices. Follow the actual wizard and responsible policy rather than assume every drive uses the same unlock method.
Keep appropriate power available and allow the supported operation to complete. Read actual progress/protection status afterwards; selecting On is not proof that all drives and external copies are protected. Stop for unexpected erase, recovery, unsupported-policy or disk-error prompts. Do not change another person’s device or managed policy as part of a personal setup.
Use the right supported feature and drive only after backup/recovery are established. Confirm actual completion and protection state; do not force eligibility through firmware/TPM changes.
Next: Review sharing, backups and unlocked accessUse FileVault with the agreed recovery choice
Use FileVault with the agreed recovery choice
Follow Apple’s FileVault guidance matching your supported Mac/version. In current macOS settings, the relevant area is System Settings, Privacy & Security, FileVault. Review the actual state and managed policy before choosing to enable it.
After backup/recovery planning, use the genuine supported setup and choose the appropriate available account/recovery-key route. Store any issued recovery key separately and privately. Where additional authorised users must unlock the startup disk, follow the supported user-enablement process; do not share one person’s login or remove legitimate users just to simplify the screen.
Keep the Mac appropriately powered and let setup finish. Confirm the actual state and normal authorised access rather than deliberately forget a password to test recovery. If login and the necessary recovery options are lost, data can become inaccessible. Do not turn FileVault off as a routine troubleshooting or verification step.
Use the actual Mac’s supported FileVault and recovery choices, with authorised-user access preserved. Confirm completion without disabling protection or provoking a lockout.
Next: Review sharing, backups and unlocked accessChoose a compatible file or removable-media method
Choose a compatible file or removable-media method
First preserve the original and choose a harmless representative copy to learn the method. Confirm who must open it, which supported apps/devices they use and how the secret will be retained. A compressed ZIP, hidden folder, worksheet lock or editing restriction is not automatically encryption that prevents reading the contents.
For a supported Windows desktop Word document, Microsoft describes File, Info, Protect Document, Encrypt with Password, confirmation and saving. Use a separately named working copy and the actual supported format/version; web and Mac controls can differ. Excel’s file-level encryption is distinct from worksheet/workbook-structure protection. Keep the password privately; do not assume a technician can recreate a forgotten one.
For removable drives or encrypted containers, use a supported method compatible with the intended readers and recovery needs. Mac external-media formats and Windows drive encryption are not universally interchangeable. Some setup methods erase/reformat a device; do not accept that on existing data without a separate preservation plan. Ask for help if the target, format or replacement effect is unclear.
Check actual file/media encryption, compatibility and recovery using a harmless copy. Preserve originals and stop before format/erase or unsupported conversions; editing locks are a different feature.
Next: Review sharing, backups and unlocked accessReview sharing, backups and unlocked access
Review sharing, backups and unlocked access
For a file recipient, agree the genuine intended person and an appropriate sharing route. Avoid placing an encrypted file and its password together in the same message. Verify the recipient separately when the request is unexpected. Do not upload confidential content to an unknown encryption/unlock website.
Check whether backups and exported/shared copies have their own required protection and recovery arrangements. Turning on device encryption does not retrospectively encrypt every attachment, cloud copy or external drive. A recipient who can legitimately open a document may still copy its contents.
Continue appropriate screen locking, supported updates and account protection. Encryption at rest does not stop someone using an already unlocked authorised session or malware with the user’s access. Our shared-computer guide explains separate users and access boundaries; our backup guide covers verifying recoverable copies.
Review the separate sharing, backup and account/access boundaries. Keep secrets apart from their content and do not treat drive encryption as a guarantee against every form of access.
Next: Verify status and authorised use without a risky testVerify status and authorised use without a risky test
Verify status and authorised use without a risky test
For device/drive protection, read the actual completed/enabled protection state for the intended target and confirm normal authorised access. For a selected-file method, close the harmless encrypted copy and reopen it through the expected supported app to confirm the opening-password behaviour and content. Keep the real original and backups while checking.
Confirm privately that the recovery record exists, matches the target and can be reached independently. Do not publish its contents, remove the only saved key, deliberately trigger a recovery screen, clear hardware security or reset a valuable device to prove the plan. Organisational recovery testing needs the responsible owner’s supported process.
Record what is protected, the method/date, where the recovery process is documented without writing the secret in a public note, and any remaining limitations. Once the intended protection and authorised use are verified, stop routine toggling. Review the plan before device disposal, hardware/firmware changes or a change of account ownership.
Confirm the intended target’s real protection state, ordinary access and private independent recovery record. Stop after verification; a lockout, erased original or public key is not a useful test.
Back to the symptom checkerGet help before key loss or destructive changes
Get help before key loss or destructive changes
Pause for an already locked device, missing recovery information, damaged storage, managed settings or uncertainty about which drive will change. Use the genuine provider’s recovery instructions and the responsible organisation where applicable. Do not use a stranger’s account to search for keys or send secrets to an unsolicited helper.
Microsoft says its support cannot retrieve or recreate a lost BitLocker key. A reset may remove files; it is not a key-recovery method. Likewise, lost FileVault or document credentials can leave content inaccessible. Keep existing backups and assess the real remaining options before accepting erasure or “guaranteed unlock” offers.
Our data-protection support can discuss an appropriate setup/recovery assessment within the actual authority and available evidence. Agree the scope, preservation, access and limitations. No provider can promise to bypass every encryption scheme or recover data without the required keys or useful copies.
Seek a scoped owner/provider assessment before resets, firmware changes or uncertain encryption operations. Keep backups and expectations realistic; erasing a locked device does not recover its missing key.
