FDE Full Disk Encryption
All data on the disk is encrypted automatically. Key unlocks at boot (passphrase, TPM, smart card). Protects against stolen/lost device, not against a running system.
Implementations: BitLocker (Windows), FileVault (macOS), LUKS/dm-crypt (Linux), VeraCrypt (cross-platform). Default cipher: AES-XTS-256. TPM stores the key and requires BIOS/UEFI to be unchanged (measured boot). Risk: cold boot attacks if RAM isn't encrypted. Modern self-encrypting drives (SED) do encryption in the drive controller instead of OS. Phones: whole disk encrypted by default since iOS 8 (2014) and Android 6 (2015).