Laptop encryption protects a lost drive, not an unlocked session
Check device encryption, preserve its recovery key and distinguish powered-off data protection from account and malware security.
In brief
Device or full-disk encryption makes stored data difficult to read without the required keys. It is valuable if a laptop or drive is lost, but it does not stop someone using files through an already unlocked session.
Confirming recovery access before repair or hardware changes protects you from turning your own encryption into a lockout.
Check the actual protection
On supported Windows devices, inspect Device encryption or BitLocker controls; on macOS, review FileVault and the system’s data-protection guidance. Confirm the intended volumes are covered. Do not infer encryption merely from a password being required at login.
Preserve recovery independently
Record the required recovery key or method securely and verify its device identifier. A copy only on the encrypted drive is not a recovery route. Keep it private: possession may permit access to protected data. Review recovery before firmware, hardware or ownership changes.
Protect the live session too
Use a screen lock, supported updates and separate accounts on shared devices. Encryption does not stop malware reading data the signed-in account can access. Protect backups separately and remove access appropriately before transferring ownership.
Before you act
Encryption availability depends on the device and OS edition. A login password, a folder lock and full-device encryption are not identical protections.
What to do next
- Inspect the operating system’s device encryption or disk-encryption status.
- Store the required recovery information in a secure location separate from the laptop.
- Test normal lock/unlock and verify the recovery record belongs to this device before repair or major changes.
