How to Encrypt a Hard Drive on Windows, Mac & Linux

Administrator access is required because encryption changes system‑level settings and manages security keys. Without these privileges, you cannot enable or configure drive encryption, making this step essential to start the process.

Opening the Settings app gives you direct access to the system’s encryption controls, where you enable and configure Device Encryption or BitLocker to secure the drive.

This step takes you to the system’s built‑in encryption settings, where you activate and configure the feature. Accessing this menu is the only way to apply full‑drive protection through Windows’ native tools.

Switching this on begins full‑disk encryption and applies the necessary keys at the system level. It triggers the background encryption process and creates a recovery key, without which the drive remains unsecured.

Opening Finder provides direct access to the drives connected to your Mac, whether internal or external. From here, locate the specific drive you want to encrypt and access the encryption option in its context menu.

Right‑clicking the drive opens its context menu, which contains the Encrypt option. This step gives you direct access to the command that starts the encryption process for that specific drive.

Clicking Encrypt launches the actual encryption process for the selected drive. Entering a strong password creates the key that will lock and unlock the data, ensuring only authorized access.

Clicking Encrypt Disk confirms your choice and starts the encryption process for the selected drive. This action applies the password and encryption settings you configured, locking the data so it can only be accessed with the correct credentials.

Terminal command: cryptsetup –version

Running this command confirms whether the cryptsetup utility is installed on your Linux system. The cryptsetup command is the primary tool used to create and manage LUKS‑based encryption. Verifying its presence at the start ensures you can proceed with the encryption process without interruptions.

Terminal command: lsblk

Running lsblk lists all storage devices and their partitions currently connected to your system. This step prevents accidental formatting of the wrong device and confirms the system recognizes the drive you plan to encrypt.

With the external hard drive plugged in, the operating system can detect the device and make it available for encryption.

Terminal command: lsblk

Running lsblk after connecting the external hard drive lets you confirm that the system has detected it and helps you identify its exact device name (for example, /dev/sdb).

Terminal command (example using rsync): rsync -avh /path/to/source/ /path/to/backup/location/

Backing up is essential because encrypting a drive erases all existing data during the formatting process. Without creating a backup, all current data on the drive will be permanently lost once encryption begins.

Terminal command: sudo umount /dev/sdX1

(Replace sdX1 with the correct partition name for your drive.)

Unmounting ensures the drive is not in active use by the system before encryption begins. This step prevents data corruption, avoids conflicts with open files, and allows encryption tools to take full control of the device. 

Terminal command (option 1 – quick wipe of filesystem signatures): sudo wipefs –all /dev/sdX

Terminal command (option 2 – full overwrite): sudo dd if=/dev/zero of=/dev/sdX bs=1M status=progress

(Replace /dev/sdX with your actual device name.)

hard drive data sanitization removes all existing filesystems, partitions, and residual data. This step ensures no old data remains accessible and prevents conflicts between previous formatting and the new encrypted volume. By starting with a clean device, the encryption process can apply a fresh LUKS header and secure the entire storage space without leaving unencrypted remnants.

Terminal command: sudo cryptsetup luksFormat /dev/sdX

(Replace /dev/sdX with the correct device name for your drive.)

This command initializes the drive with a LUKS header and sets up the encryption parameters. It’s the point where the device is actually prepared for secure storage, and you’ll be prompted to create a strong passphrase.

Terminal command: sudo cryptsetup open /dev/sdX my_encrypted_drive

(Replace /dev/sdX with your device name and my_encrypted_drive with a name you choose for the mapping.)

This step unlocks the LUKS‑encrypted device using the passphrase you set earlier, creating a mapped device under /dev/mapper/. Opening the partition lets the system access it as a usable block device, allowing you to format it with a filesystem and store data securely.

Terminal command: lsblk

After opening the encrypted device with cryptsetup, running lsblk shows where it has been mapped. This confirms that the system recognizes the unlocked encrypted volume and tells you the exact mapped path to use for creating a filesystem. 

Terminal command (example using ext4): sudo mkfs.ext4 /dev/mapper/my_encrypted_drive

(Replace my_encrypted_drive with the mapped name you chose when opening the encrypted device.)

This step formats the unlocked encrypted volume with a usable filesystem so the operating system can store and retrieve files on it.

Terminal command (for ext4 filesystems): sudo tune2fs -m 0 /dev/mapper/my_encrypted_drive

(Replace my_encrypted_drive with the mapped name of your encrypted volume.)

By default, ext4 reserves a small percentage of disk space for the root user and system processes. On an external or dedicated data drive, this reserved space is usually unnecessary. Removing it frees up the full capacity of the encrypted volume for your files.

Terminal command: sudo cryptsetup close my_encrypted_drive

(Replace my_encrypted_drive with the mapped name you used when opening the device.)

Closing the encrypted device ends the active mapping between the unlocked volume and the system. This ensures the encryption layer is fully engaged, making the data inaccessible without the passphrase. It prevents unauthorized access if the drive is removed or the system is shut down, maintaining the security of the stored information.