FDE

FDE encrypts an entire storage drive so its contents are unreadable without the right key, typically unlocked at boot. Tools like BitLocker and FileVault implement it on corporate laptops, often with keys protected by the TPM. It is the main defense against data theft from lost or stolen devices, though it does nothing once the machine is unlocked and running.