What is Full-disk encryption?

Encrypting an entire drive so its contents are unreadable without the key — on Linux, typically LUKS — protecting data if the machine is lost, stolen, or booted from USB.

How it works

Without it, anyone with physical access can mount the disk and read everything. LUKS encrypts at the block layer, so it protects data at rest transparently once unlocked. It does NOT protect a running, logged-in machine.

Example

In practiceDuring Ubuntu install you choose 'Encrypt the new Ubuntu installation for security' and set a passphrase; the disk unlocks at boot.

Does full-disk encryption protect a running system?

No. It protects data at rest. Once unlocked and logged in, the data is readable by anything running as you.

Go deeper: Build a Hardened Linux Workstation

The complete, step-by-step guide — every command, config, and the reasoning behind it.

Get the guide