Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Enable full-volume encryption before an SSD can be lost. On Windows, check whether Device Encryption is active; where supported, configure BitLocker for each internal or external volume that contains sensitive data. On a Mac, turn on FileVault and confirm the startup volume is encrypted. Keep the recovery information somewhere separate and secure. If the SSD is later sold, transferred, recycled, or discarded, encryption is not enough: use a sanitization method appropriate to the drive and your data-handling requirements.
Encryption and sanitization solve different problems
Encryption protects data while the drive remains in your possession but is powered off, locked, or removed from its computer. A full-volume encryption system transforms the contents into ciphertext and releases the decryption key only after the required device authentication succeeds. Someone who removes an encrypted SSD and connects it to another computer should not be able to read the files offline.
That protection depends on the drive still being encrypted and the attacker not obtaining an already-unlocked session, a password, or a recovery key. Encryption does not clean data from a drive that you are handing to another person. A retired SSD can retain recoverable information in cells, spare areas, or remapped blocks even after files are deleted. Sanitization is the separate process used when media leaves your control. NIST’s storage-encryption guidance covers full-disk, volume, virtual-disk, and file/folder approaches; the right scope depends on the storage type, the amount of data, the environment, and the threats you are addressing.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →| Situation | Primary control | What you must verify |
|---|---|---|
| Laptop or desktop could be lost or stolen | Full-volume encryption enabled in advance | The target startup and data volumes are encrypted and the device requires authentication after shutdown |
| Secondary internal SSD contains private files | Encryption on that specific volume | Coverage includes the secondary volume, not just the operating-system volume |
| Removable external SSD is carried between computers | Encryption designed for that removable volume | The operating system did not merely encrypt the internal disk while leaving the external disk readable |
| Drive is sold, transferred, recycled, or discarded | Media sanitization | The method is supported by the SSD maker and meets your policy and sensitivity requirements |
Choose the built-in method for your computer
| Platform | Built-in option | Eligibility and scope | Recovery consideration |
|---|---|---|---|
| Windows 10 or 11 | Device Encryption | Available on a wider range of hardware, including some Home-edition systems. Hardware eligibility, sign-in requirements, and which volumes are covered vary. | Confirm that recovery information has been saved and is accessible before an emergency. |
| Windows 10 or 11 and listed supported editions | BitLocker Drive Encryption | Full-volume encryption for supported editions. Configure and check each volume you need protected. | The required authentication or recovery information is necessary to unlock the drive. |
| Mac with Intel processor | FileVault | Apple describes FileVault as volume encryption for the startup volume. | Keep the FileVault recovery key or approved account-recovery path separate from the Mac. |
| Mac with Apple silicon | FileVault plus Apple’s hardware-backed data-protection architecture | Apple silicon uses a different key-management architecture from Intel Macs; use the current macOS controls and verify the resulting state. | Do not assume the architecture removes the need for account credentials or recovery planning. |
Signing in to an operating system does not prove that every SSD attached to it is encrypted. Treat the status of the particular internal, secondary, or removable volume as the thing to check.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
Encrypt an SSD in Windows
1. Check for Device Encryption
Device Encryption is the first place to look because it can appear on hardware and Windows editions where the full BitLocker management interface is unavailable.
- Open Settings and search for Device encryption. On systems that expose the setting, open the Device encryption page.
- Read the status rather than inferring it from your Microsoft-account sign-in. If the switch is off, turn it on and allow Windows to complete the encryption process while the computer is connected to power.
- Check which storage is covered. Some implementations protect the operating-system volume but do not automatically cover every secondary or removable SSD.
- Wait for the status to report completion before treating the device as protected. Interrupting the process, removing the drive, or powering off during setup can leave protection incomplete.
If the setting is absent, the hardware may not meet Microsoft’s eligibility requirements, the edition may not provide Device Encryption, or an administrator may have disabled it. Use BitLocker where your edition supports it, or apply an encryption product approved by your organization; do not assume that an absent toggle means the disk is encrypted.
2. Turn on BitLocker for a supported Windows edition
- Open Control Panel, choose System and Security, then BitLocker Drive Encryption. The exact management page can differ by Windows version and organization policy.
- Find the SSD volume you want to protect and select Turn on BitLocker. Start with the operating-system volume, then configure any fixed data volume separately if it contains sensitive information.
- Choose how the drive will unlock. A system volume normally uses the computer’s startup authentication and hardware security; a data volume may require a password, smart card, or another configured protector.
- When Windows offers to save a recovery key, store it in a location separate from the computer and the SSD. Use an approved Microsoft-account, directory, printed, or managed-record option that your security policy permits. Do not leave the only copy in a folder on the encrypted drive.
- Select the encryption scope presented by Windows. Encrypting used space is faster for a new or empty drive; encrypting the entire drive is appropriate when previously used space may contain sensitive remnants. Follow your organization’s policy if it specifies one.
- Choose the current encryption mode offered for your Windows version and start encryption. Keep the computer powered and avoid disconnecting an external SSD until Windows reports completion.
- After completion, restart and confirm that the volume requires the expected authentication. A successful setup is not complete until you know how the recovery path works.
Microsoft positions BitLocker as protection against data exposure from lost, stolen, or decommissioned devices. It does not protect files after you have unlocked the computer and an attacker can use your active session, nor does it sanitize a drive that you give away.
3. Verify every Windows volume
Use the BitLocker management page to inspect each listed volume. It should show an encrypted or protection-on state, not merely a control that allows you to begin encryption. Advanced users can also inspect status with Microsoft’s documented BitLocker command-line tools, such as manage-bde, from an elevated command prompt; use the status operation for the drive letter you are checking and read the encryption percentage, conversion status, and protectors. Command names and administrative permissions vary by Windows release, so do not paste an unverified command into a production system.
- Check the startup volume.
- Check every fixed secondary SSD.
- Connect each removable SSD and verify its own encryption state instead of assuming the computer’s internal disk setting applies to it.
- Record where the recovery information is held and test that an authorized administrator can retrieve it.
4. Protect and test the recovery path
Microsoft warns that a BitLocker-protected drive needs the required authentication or recovery information to unlock. If the recovery material is lost, the data may be permanently unrecoverable. Keep a copy in a secure location that is not carried with the SSD, restrict who can access it, and follow your organization’s retention rules. Do not delete a recovery key simply because normal unlock works; create and verify a replacement first if your policy requires rotation.
Rank #2
- Blazing fast NVMe technology with speeds of up to 1050MB/s and write speeds of up to 1000MB/s. | Based on reading speed unless otherwise stated. As used for transfer rate, 1 MB/s = one million bytes per second. Based on internal testing; performance may vary depending upon host device, usage conditions, drive capacity, and other factors
- Password enabled 256-bit AES hardware encryption
- Shock and vibration resistant. Drop resistant up to 6.5ft (1.98m)
- Cross Compatible USB 3.2 Gen-2 and USB-C (USB-A for older systems)
A practical test is to confirm, before travel, that the recovery record identifies the correct device and that an authorized person can locate it without having to read the encrypted drive. Avoid putting an unprotected recovery-key file on the same laptop, in the same bag, or on the same removable SSD.
Encrypt a Mac SSD with FileVault
Turn on FileVault for the startup volume
- On recent macOS versions, open System Settings, choose Privacy & Security, and open FileVault. Older releases use System Preferences, then Security & Privacy, then FileVault.
- Select Turn On FileVault and authenticate with an administrator account.
- Choose the permitted recovery method. macOS may offer an Apple-account recovery route or a generated recovery key, depending on version and configuration.
- Record the recovery information in a secure location separate from the Mac. Anyone who has it may be able to unlock the volume, while losing it can prevent recovery.
- Leave the Mac connected to power and allow encryption to finish. The computer can generally be used during conversion, but completion time depends on the SSD capacity and activity.
- Return to the FileVault pane and verify that it reports encryption is on or complete. Restart once, when convenient, to confirm that the expected login unlocks the startup volume.
Apple describes FileVault as volume encryption on Intel Macs. Apple silicon Macs use a different, hardware-backed data-protection architecture with integrated key management; the visible settings and terminology can change between macOS releases. The operational rule is the same: enable the available protection, verify its state, and preserve the recovery path.
Covering external and secondary Mac SSDs
FileVault’s primary job is protecting the startup volume. A second internal volume or a removable SSD may need its own encryption configuration. In Finder, select the external volume and use the available encryption option, or use an approved encrypted container when the volume must travel between different operating systems. macOS can require the volume to be reformatted for encryption, so back up its contents first and confirm compatibility with every computer that must read it.
After configuration, eject and reconnect the SSD. A password prompt or an explicitly encrypted-volume status is stronger evidence than the mere fact that FileVault is enabled on the Mac’s startup disk.
What changes when the SSD is lost?
If encryption was completed before the loss, shut down or lock the associated computer through your normal device-management system, revoke sessions and credentials as appropriate, and report the incident under your organization’s process. Encryption addresses offline reading of the SSD; it does not revoke a cloud session, erase files that were synchronized elsewhere, or stop an attacker who already has an unlocked session.
Rank #3
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
- Do not send a recovery key to an unknown person who claims to have found the drive.
- Change account credentials if the lost computer may have been unlocked or if passwords were stored locally.
- Check whether removable SSDs were encrypted independently; an encrypted internal disk does not make an unencrypted USB drive safe.
- Document the device identifier and the encryption state for incident responders.
Sanitize an SSD before selling, transferring, or discarding it
Sanitization is intended to remove data so it is not readily retrieved and reconstructed. NIST describes it for media that are transferred, obsolete, or no longer needed. Microsoft’s operational guidance treats SSDs as data-bearing devices and distinguishes three outcomes: clear, purge, and destroy. The correct choice depends on the sensitivity of the information, who will receive the drive, the drive’s controller and firmware, and your legal or organizational policy.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Method | Meaning | When it may fit | SSD caution |
|---|---|---|---|
| Clear | Logical techniques intended to prevent ordinary software-based recovery through the user interface or standard operating-system access. | Lower-risk reuse within a controlled environment when policy allows. | Simple file deletion or formatting is not automatically a clear operation, and wear levelling can leave old cells outside the visible address space. |
| Purge | A stronger technique that makes recovery infeasible using state-of-the-art laboratory methods for the applicable threat model. | Transfer or reuse when the data sensitivity requires more than routine clearing. | Use a manufacturer-supported sanitize, secure-erase, or cryptographic-erase function for the exact model; do not assume a generic overwrite pass is effective. |
| Destroy | Physical destruction that prevents the media from being reused and makes data recovery impractical. | Highly sensitive data, failed drives that cannot be reliably sanitized, or a policy requiring destruction. | Use a qualified destruction service or procedure that covers the entire SSD, including chips and controller components, and obtain the required record of destruction. |
A safe retirement decision process
- Classify the data. Identify whether the SSD held credentials, personal data, regulated records, trade secrets, or only disposable files.
- Confirm a backup. Verify that any data you must keep has been restored or copied before sanitization begins. Sanitization is intentionally destructive.
- Identify the exact model and state. Record the manufacturer, model, capacity, firmware, interface, and whether it is a self-encrypting drive. The supported sanitization commands can differ.
- Read the maker’s current procedure. Prefer a documented sanitize, secure-erase, or cryptographic-erase operation for that model. Follow prerequisites such as removing a frozen state, connecting directly to a supported port, or using the vendor’s bootable utility.
- Choose clear, purge, or destroy under your policy. Do not select a method only because it is convenient or fast.
- Run the operation without interruption. Keep power stable and do not disconnect the SSD while the controller is processing the command.
- Verify and document the result. Use the tool’s completion report or an independent verification required by policy. Record the date, operator, device identifier, method, and result.
- Only then transfer or recycle the drive. If the operation fails, treat the SSD as containing data and escalate to a stronger method or destruction.
Do not prescribe a universal overwrite count for SSDs. Flash translation layers, spare blocks, and wear levelling mean that repeatedly writing visible sectors may not reach every physical location. Ordinary deletion, emptying the recycle bin, or a quick format is not a sanitization guarantee. Conversely, cryptographic erase is effective only when the drive’s encryption and key-destruction implementation is trustworthy and the relevant keys have not been exported or duplicated.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common mistakes and how to correct them
“I signed in, so my SSD must be encrypted.”
Account sign-in and storage encryption are separate controls. Open the platform’s encryption status and inspect the particular volume. Enable protection, wait for completion, and check again after a restart.
“BitLocker or FileVault covers every connected disk.”
Startup-volume protection does not automatically establish protection for every secondary or removable SSD. Configure and verify each volume independently.
“I can keep the recovery key on the same drive.”
A key stored only on the encrypted device disappears with that device or becomes available to anyone who obtains it. Keep it separate, access-controlled, and recoverable by an authorized person.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #4
- The External Hard Drive includes both USB-C and USB-A Cables to make your out-of-box experience great. Ready for any USB-C or USB-A ports on your computer, laptop, or other systems with USB support. Full USB 3.2 Speeds up to 5MBs.
- The desktop hard drive does not require any drivers or software to validate and unlock the drive. Users can use face ID, fingerprint, or remember the password to unlock.
- USB 3.2/3.1.3.0/2.0 compatible with all systems and Operating systems. The computer external backup storage device comes formatted NTFS for windows, but can easily be reformatted for Mac or Linux, or formatted in exFat for universal use.
- Protect your files on the desktop hard drive with the Antivirus SW included on the drive. This is a subscription service and the first year is included. Go online to activate the license.
- Included Splash Proof Pouch to keep your encrypted drive safe when carried. Keep your cables and other accessories with you. Water-resistant and shockproof case. Protect your Portable External Hard Drive when you are on the go.
“Deleting files is enough before recycling.”
Deletion removes directory references, not necessarily the underlying flash contents. Use a model-appropriate sanitization operation or destroy the SSD when the risk or policy demands it.
“Sanitization is harmless because I have a backup.”
A backup can be incomplete, corrupt, or subject to different retention rules. Open representative files from the backup and confirm that it contains everything required before starting an irreversible operation.
“An encryption prompt proves the process finished.”
Encryption can run asynchronously. Check for a completed or protection-on state, verify the volume after reboot, and confirm that a recovery method exists.
Pre-loss and retirement checklists
Before travel or everyday use
- Device Encryption, BitLocker, or FileVault is enabled and reports completion.
- The startup volume and every sensitive secondary or removable SSD are covered.
- The computer requires authentication after shutdown or restart.
- Recovery information is stored separately, securely, and is accessible to an authorized person.
- Backups are current and encrypted according to their own risk.
Before handing off an SSD
- The data has been backed up and verified.
- The exact SSD model and policy requirements are known.
- A supported clear, purge, or destroy method has been selected.
- The operation completed and its result was recorded.
- The drive is not transferred if sanitization failed or cannot be verified.
Bottom line
Encrypt first, while the SSD is still under your control: verify Device Encryption or BitLocker on Windows, FileVault on a Mac, and coverage for every volume that matters. Preserve the recovery information separately. When the drive is retired, stop treating encryption as the final step—apply a model-appropriate sanitization method, or destroy the media when the sensitivity and policy require it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
