To protect confidentiality of the data stored on a computer disk a computer security technique called disk encryption is used. This article discusses software which is used to implement the technique (for cryptographic aspects of the problem see disk encryption). Compared to access restrictions commonly enforced by an OS, this technique allows data be to be protected even when the OS is not active, for example, if data is read directly from the hardware.
Such software encrypts data stored on a computer's mass storage and transparently decrypts the information when an authorized user requests it: no special action by the user (except supplying a password or passphrase at the beginning of a session) is required. Some also provide plausible deniability with deniable encryption techniques.
The volume-level encryption is particularly suited to portable devices such as laptop computers and thumb drives. If used properly, someone finding a lost device will have access only to inaccessible encrypted files. A strong passphrase (e.g. five or more diceware words) is essential for full security.
Although disk encryption software can transparently operate on an entire disk volume, a directory, or even a single file, it is important to differentiate it with (non-transparent) file encryption software which encrypts or decrypts only individual files and always the whole file (the decrypted file is stored in a temporary file in an unencrypted form). Examples of software which can be used for file encryption are special-purpose software (e.g., GNU Privacy Guard and PGP), file archivers, and even some text editors (e.g., emacs or vi)
This section lists features commonly found in disk encryption software, though not all functions may be provided in any given system.
Some disk encryption systems offer two levels of Plausible Deniability, which might be useful in case a user is required to reveal the password of an encrypted volume.
Once a hidden volume has been created inside another volume, the user will store important-looking information (but which the user does not actually mind revealing) on the outer volume, whereas sensitive information is stored within the hidden volume.
In the event the hidden volume user is forced to reveal their password, they can divulge the password to the outer volume (not disclosing the fact that they actually have a hidden volume within), and sensitive data within the hidden volume is not compromised; provided certain additional precautions are taken in overwriting the free areas of the "host" disk.
Volumes, be they stored in a file or a device/partition, may intentionally not contain any discernible "signatures" or unencrypted headers. As cipher algorithms are designed to be indistinguishable from a pseudorandom permutation without knowing the key, the presence of data on the encrypted volume is also undetectable unless there are known weaknesses in the cipher. This means that it is impossible to prove that any file or partition is an encrypted volume (rather than random data) without having the password to mount it. This characteristic also makes it impossible to determine if a volume contains another hidden volume.
A file hosted volume (as opposed to partitions) may look out of place in some cases since it will be entirely random data placed in a file intentionally. However, a partition or device hosted volume will look no different than a partition or device which has been wiped with a common disk wiping tool such as DBAN. One can plausibly claim that such a device or partition has been wiped to clear personal data.
Portable or "traveller mode" means the encryption software can be run without installation to the system hard drive. In this mode, the software typically installs a temporary driver from the portable media. Since it is installing a driver (albeit temporarily), administrative privileges are still required
Restoring the backup copy of this data may reset the volume's password to what it was when the backup was taken.