Full-disk encryption Protects the data on a drive if the device itself is lost or stolen.
Short answer. Full-disk encryption (FDE) encrypts everything on the drive that boots a computer, operating system included, and allows access only after successful authentication. NIST’s guide explains that it protects a computer that is switched off: once the machine has booted, FDE offers no further protection and the operating system is responsible. Its main job is to defend against a lost or stolen device. On Windows the tool is BitLocker, which Microsoft says gives maximum protection with a TPM chip; Ubuntu uses LUKS with AES-256 by default. For an office AI server, FDE answers “what if someone walks out with the box?” but not “what if someone signs in?”.
01
How it works
NIST describes software FDE as redirecting the computer’s start-up to a pre-boot environment that asks the user to authenticate before the operating system is decrypted and started. Newer machines can hold the key in a Trusted Platform Module (TPM), a chip that helps check that the machine has not been tampered with while it was off. Microsoft says BitLocker can also insist on a PIN or a USB startup key before the machine starts or resumes from hibernation.
On Linux, Ubuntu’s documentation describes full-disk encryption through LUKS: a volume key encrypts the data, the volume key is itself encrypted and stored in the LUKS header, and the default cipher is AES-256 in XTS mode. macOS has its own tool, FileVault.
02
What it protects, and what it does not
Situation
Protected?
Why
Box stolen while powered off
Yes
NIST: a computer that is not booted is protected, assuming pre-boot authentication
Drive removed and read in another machine
Yes
Microsoft: BitLocker addresses data exposure from lost or stolen devices, including a drive moved to another device
Old device recycled or sent for repair
Yes, if encryption was on from the start
Microsoft: data becomes inaccessible when protected devices are decommissioned or recycled
Box stolen while running
No
NIST: once booted, FDE provides no protection
A staff member with a valid sign-in copies files
No
Files are decrypted for any authorised user
Malware running on the system
No
It runs after the disk has been opened for use
Backups kept elsewhere
Only if they are encrypted too
FDE covers one drive
03
Start-up, power cuts and recovery keys
A PIN or passphrase at start-up is stronger, but it means the machine cannot restart unattended. Microsoft says a PIN-protected device cannot start or resume until the correct PIN or startup key is presented, so after a power cut the box waits at the pre-boot screen until someone types it. Releasing the key from the TPM alone lets the machine restart by itself, at the cost of relying on the TPM and on the physical security of the room. Decide which you want before installation, and write down who holds the PIN.
NIST warns that a lost or damaged key may make the data unrecoverable. Keep the recovery key apart from the device, in a place two people can reach, and test the recovery process before you need it.
04
A buying checklist
Is the drive encrypted from the first boot, or is encryption an option someone must remember to switch on?
Where is the key kept: a TPM, a PIN, a USB key or a network key server?
What happens after a power cut: an automatic restart, or a person at the keyboard?
Who holds the recovery key, and has recovery been tested?
Are data drives and external storage covered, or only the system drive?
Are backups encrypted?
What is the process when the box is repaired or retired?
05
Where ANVE stands
ANVE’s security page (/security) says everything sits in one database on the box, and that full-disk encryption and secure boot are part of the appliance image, which is not on ANVE yet. Our question page on theft of the AI box says more. Put the checklist above to ANVE in writing before a paid pilot, as you would to any vendor.
06
Questions people ask
Is FDE enough to protect an AI server?
It covers theft and recycling. It does not cover a signed-in attacker, a malicious insider or malware, so pair it with access control, logging, network controls and encrypted backups.
Does FDE protect against ransomware?
No. Ransomware runs on a booted system, where FDE offers no protection. Offline backups are the main defence; see backup and restore.
What are BitLocker, FileVault and LUKS?
BitLocker is Microsoft’s tool for Windows, FileVault is Apple’s for macOS, and LUKS is the Linux framework that Ubuntu uses. All three encrypt storage so it cannot be read without the key.
Is full-disk encryption the same as encryption at rest?
FDE is one form of encryption at rest. The encryption at rest page also covers volume, file and backup encryption.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
