Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
“Encrypted at rest unless it cannot be, and the file itself says which” sounds like a simple rule, but it combines two different questions: whether stored data is encrypted, and whether a file can report that status. Encryption at rest describes protection for data while it is stored; it does not guarantee that every file contains a reliable indicator of that protection.
What does “encrypted at rest” mean?
Encryption at rest protects data while it is stored, such as on disks or backup media. Google Cloud describes the term in those terms in its overview of default encryption at rest. Microsoft likewise explains encryption of stored data in its Azure data-encryption guidance.
The phrase describes a data state, not necessarily a property embedded in a particular file. Protection may be applied by the file format, beneath the file system, or by a storage service. These layers can coexist, but they do not automatically share a status flag.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Can a file tell you whether it is encrypted at rest?
Sometimes a file format can indicate or document that its own contents are encrypted. That tells you about protection implemented within that format; it does not, by itself, establish whether the disk, file system, backup, or cloud service holding the file is encrypted.
#1 Best Overall
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
There is no universal metadata field established by the sources here that lets arbitrary files report their current at-rest status across all formats and storage systems. A file may not know that an external storage layer encrypts it, or whether that layer’s status has changed. A reliable indicator therefore has to identify the layer it describes and, for a storage-layer claim, come from a system that can verify that layer.
Where can encryption be applied?
| Layer | What it protects or describes | What a file-level indicator can establish |
|---|---|---|
| Within the file format | The format or application encrypts the file’s contents. | It may indicate format-level encryption, if that format defines a way to do so. It does not establish storage-service encryption. |
| Beneath the file system | A lower storage layer protects data written to storage. | A file generally cannot establish this status merely from its own format metadata. |
| Storage service | A managed service handles encryption around storage operations. | The service or its verified configuration is the relevant source of status, not an unconnected file marker. |
Microsoft’s Azure File Sync planning documentation distinguishes encryption beneath the file system from encryption within the file format, and notes: “These methods aren’t mutually exclusive. You can choose to use them together because the purpose of encryption is different.” In practice, a document can have format-level encryption while the storage service also encrypts the underlying stored data.
Rank #2
- FIPS 197 with XTS-AES 256-bit Encryption: Provides business-grade security with hardware-based encryption to protect your sensitive data
- Brute Force and BadUSB Attack Protection: Safeguards against unauthorized access attempts and malicious USB attacks with digitally-signed firmware
- Multi-Password Option with Complex/Passphrase modes: Offers flexible password configuration options to meet various security requirements and user preferences
- New Passphrase Mode: Enhanced security feature allowing users to create longer, more memorable password phrases for easier access without compromising protection
- Dual Read-Only (Write-Protect) Settings: Enables write protection functionality to prevent accidental data modification or deletion when needed
Why storage encryption may be invisible to a file
Storage-layer encryption can be transparent to applications. AWS says that Amazon FSx for OpenZFS encrypts data and metadata before writing them and decrypts them before presenting them to the application in its encryption-at-rest documentation. An authorized application can therefore receive ordinary file contents even though the persisted copy is protected underneath it.
Free tools Windows power users keep installed
One-click scans. No signup required.
That transparency is useful operationally, but it means the application’s view of a file is not proof of the storage layer’s encryption state. The file can look and behave normally after the service has decrypted it for use.
Rank #3
- Certified to FIPS 197 - U.S. Government Approved High Level Information Security Standard.
- Protection against brute force password attacks - Data is automatically erased after 6 unsuccessful access attempts. The data of the USB flash drive type c encryption with dual connectors is destroyed and the cryptographic drive is reset.
- Durable dual-layer waterproof design* — Protects the crypto reader from bumps, drops, run-in and immersion in water. The electronics are protected by a hardened internal case. Rubberized silicone outer case provides a final layer of protection.
- Auto-Lock —The cryptographic key automatically encrypts all data and locks when removed from a PC/Mac or when screen protection or "computer lock" is enabled.
- Secure Entry —Data on these flash drives cannot be accessed without the correct alphanumeric password of 8 to 16 characters. A password indication option is available for this flash drive. The hint cannot match the password.
At rest is different from in transit
Encryption at rest concerns stored data. Encryption in transit concerns data as it moves between a client and a file system or service. AWS separates these protections in its Amazon EFS encryption documentation. A claim that a file is encrypted while stored does not, on its own, say anything about how it is protected during transfer.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What an encryption indicator should say
If you are designing a label, metadata field, or security report, state the boundary precisely rather than using an unqualified “encrypted” status. For example, distinguish “file-format encryption enabled” from “storage service encryption enabled,” and identify the system that reports the latter.
Rank #4
- FIPS 140-2 Level 3 Validation (pending 1 Q 2019)
- Aegis Configurator Compatible
- Separate Admin and User Mode
- Two Read-Only Modes
- Data Recovery PINs
- Specify the layer: file format, file system, or storage service.
- State the coverage: contents, metadata, or both. Coverage varies by implementation; Google Cloud’s overview explicitly places metadata protections outside its document’s focus, while FSx for OpenZFS describes encryption of data and metadata.
- Identify key control: explain who can manage or access the keys and what access controls apply. Google Cloud describes customer key-management options through Cloud KMS, and Microsoft discusses key storage and access controls in its at-rest guidance.
- Separate stored and moving data: report at-rest and in-transit protection independently.
- Use a verifiable source for current status: a file-level marker should not be presented as proof of an external storage configuration unless the system explicitly connects it to verified status.
Key management matters because encryption’s practical protection depends on control of the keys as well as the encryption mechanism. Provider guidance describes different key-management and access-control models, so check the relevant service’s current documentation rather than treating one provider’s model as universal.
Quick Recap
Best Value
- XTS-AES 256-bit hardware-encryption
- FIPS 197 certified
- Multi-Password (Admin and User) option with complex/passphrase modes
- Up to 145MB/s Read, 115MB/s Write
How to interpret a claim about a file
- Ask what “encrypted” refers to. Is the claim about encryption within the file format, or the storage system holding the file?
- Check what the indicator can observe. A format can report on its own contents; a storage service or administrator is better placed to report on underlying storage configuration.
- Check scope and keys. Determine whether the claim covers content, metadata, or both, and who controls the keys.
- Keep transport protection separate. Confirm in-transit protection independently if data is sent between systems.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
