The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Enable full-volume encryption before the SSD leaves your control, then handle retirement as a separate sanitization job. On Windows, check Device Encryption and use BitLocker Drive Encryption where your edition and hardware support it. On a Mac, turn on FileVault for the startup volume. Confirm that the specific internal, secondary, or removable SSD is covered, and make sure the recovery information is available before you need it. When the drive is sold, transferred, or discarded, encryption alone is not enough: choose a sanitization method appropriate for that SSD and your data-retention requirements.
Encryption protects a lost drive; sanitization prepares a retired drive
These two situations are easy to confuse because both involve data leaving your immediate control. They require different controls.
As an Amazon Associate I earn from qualifying purchases.
- Loss or theft: The SSD is still in use or may be recovered. Full-volume encryption is intended to keep its contents unreadable without the required authentication or recovery information. An attacker who removes the drive and connects it to another computer should encounter encrypted data rather than ordinary files.
- Retirement: You are selling, transferring, recycling, or discarding the SSD. Sanitization is the process of removing data so it cannot be readily retrieved and reconstructed from the media. The drive may be encrypted today, but you should not rely on the recipient never obtaining a key, a logged-in computer, or another path to the data.
NIST’s storage-encryption guidance covers full-disk or full-volume encryption, virtual-disk encryption, and file-or-folder encryption. The suitable scope depends on the storage type, how much data must be protected, the operating environment, and the threats you are addressing. For a laptop or desktop that could be lost, full-volume protection is usually the clearest baseline because it covers the operating-system volume without requiring you to identify every sensitive file.
Free tools Windows power users keep installed
One-click scans. No signup required.
When a drive is leaving your control, follow current sanitization guidance from the drive maker and any policy that applies to your organization. Microsoft’s operational guidance treats SSDs as data-bearing devices and distinguishes clear, purge, and destroy; those categories are useful for planning, but the exact procedure is not universal across SSD models.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
Choose the encryption scope before changing settings
Internal startup SSD
This is the drive that contains Windows or macOS and commonly holds browser data, documents, cached credentials, and application files. Device Encryption or BitLocker on Windows and FileVault on macOS are the platform-level choices to check first.
Secondary internal SSD
A second drive in the same computer is not automatically protected merely because the startup volume is encrypted. Verify that the secondary volume itself is encrypted. If it contains only non-sensitive material, you may choose a different control, but make that a deliberate decision rather than an assumption.
Removable or external SSD
An operating system can protect its own startup volume while leaving a connected removable SSD unencrypted. Confirm coverage for the particular removable volume and for every computer on which it is used. NIST’s guidance includes removable media and recognizes that storage encryption can be applied at different scopes.
File or folder encryption
Encrypting selected files can be appropriate when only a small, well-defined set of data needs protection or when the storage environment cannot provide volume encryption. It creates more decisions, however: you must identify every sensitive file, preserve the keys, and ensure new copies and temporary files receive equivalent protection. It is not a substitute for startup-volume encryption on a computer that may be stolen.
Prepare before enabling encryption
Encryption changes how the computer unlocks its storage. Complete these checks while the system is working normally.
- Identify the target SSD and volumes. Note whether the data is on the startup drive, a fixed secondary drive, or removable media. Do not infer coverage from the fact that you can sign in to Windows or macOS.
- Update and back up first. Keep a current backup of important files on separate storage. Encryption does not protect against accidental deletion, hardware failure, ransomware, or a damaged filesystem.
- Confirm account access. Make sure you can sign in with the account that administers the computer and that you know the password or other authentication method used at startup.
- Plan recovery storage. A BitLocker-protected volume may require a recovery key after a hardware or firmware change. Store the recovery information in a safe location that you can reach during an emergency but that does not undermine the protection of the computer itself.
- Check every volume. After encryption is enabled, inspect the status of each relevant volume. A protected C: drive does not prove that a second internal SSD or external SSD is protected.
Microsoft warns that losing required recovery information can make the data unrecoverable. Do not delete recovery keys to reduce clutter, and do not keep the only copy on the encrypted drive it is meant to unlock.
Encrypt an SSD on Windows
Windows has two built-in routes. Their availability and coverage differ by edition, device hardware, and configuration, so use the route your computer actually offers.
Check Device Encryption
Device Encryption is available on a wider range of Windows devices, including some systems running a Home edition. Hardware eligibility and the drives covered vary.
- Open Settings.
- Go to Privacy & security, then look for Device encryption. On some Windows versions the entry appears under a slightly different security heading; use the Settings search box for “Device encryption” if necessary.
- Read the status rather than assuming that signing in with a Microsoft account means encryption is active. If the switch is available and off, turn it on and follow the prompts.
- After Windows completes the operation, return to the page and confirm that Device Encryption reports an enabled state.
- Check whether the setting covers the secondary or removable SSD you care about. If the page does not identify that drive, verify it separately with the drive’s encryption status in Windows.
Device Encryption is convenient when offered, but it is not a promise that every connected volume is encrypted. Treat the status page as a starting point and verify the actual target drive.
Use BitLocker Drive Encryption where supported
BitLocker Drive Encryption is Microsoft’s full-volume encryption feature for supported Windows editions and listed server editions. Microsoft describes it as protection against data theft or exposure from lost, stolen, and decommissioned devices.
Rank #2
- Blazing fast NVMe technology with speeds of up to 1050MB/s and write speeds of up to 1000MB/s. | Based on reading speed unless otherwise stated. As used for transfer rate, 1 MB/s = one million bytes per second. Based on internal testing; performance may vary depending upon host device, usage conditions, drive capacity, and other factors
- Password enabled 256-bit AES hardware encryption
- Shock and vibration resistant. Drop resistant up to 6.5ft (1.98m)
- Cross Compatible USB 3.2 Gen-2 and USB-C (USB-A for older systems)
- Sign in with an administrator account.
- Open Control Panel, choose System and Security, and select BitLocker Drive Encryption. You can also search the Start menu for “Manage BitLocker.”
- Find the SSD volume you want to protect. For the startup volume, select Turn on BitLocker. For a fixed secondary volume, use the corresponding action for that drive.
- Choose how the drive should be unlocked when Windows requests the option. Follow the prompts for the available authentication method on your edition and hardware.
- Save the recovery information when prompted. Keep at least one accessible copy outside the drive being protected, and protect that copy from unauthorized access.
- Choose the encryption mode and scope offered by your Windows version, then start encryption. Keep the computer connected to power and avoid interrupting the process.
- Return to the BitLocker management page and confirm that the intended volume shows as protected. Check every additional SSD separately.
Labels and available choices can change between Windows 10, Windows 11, editions, and hardware. If BitLocker is absent, that does not prove the drive cannot be encrypted; Device Encryption may be available instead. If neither option is present, use an encryption method supported by your organization and the SSD’s operating environment rather than assuming protection exists.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsVerify the exact Windows coverage
Use the BitLocker management page or Windows’ encryption status information to inspect each volume. Record which drive letters or volume names are protected. A status that says the system drive is encrypted does not cover a USB-connected SSD that was attached later. For a removable drive, check its state after reconnecting it and on the computers where it will actually be used.
Encrypt a Mac SSD with FileVault
On macOS, FileVault is the user-facing setting for startup-volume encryption. Apple describes volume encryption on Intel-based Macs and a different, hardware-backed data-protection architecture on Apple silicon Macs. The security model therefore depends on the Mac generation as well as the macOS version.
Turn on FileVault
- On a recent macOS release, open System Settings and choose Privacy & Security.
- Select FileVault and choose Turn On or the equivalent enable control.
- Authenticate when macOS requests your administrator password or account credentials.
- Follow the recovery instructions shown by your Mac. Depending on the configuration, macOS may present a recovery key or an account-based recovery choice. Make sure you understand and preserve the option you select.
- Leave the Mac connected to power and allow encryption to finish. Then return to the FileVault pane and verify that it reports protection is enabled.
Older macOS releases use System Preferences and place FileVault under Security & Privacy. Interface names can change, so use the system Settings search if the listed path is not present.
Understand what FileVault covers
FileVault’s normal target is the Mac’s startup volume. A second internal volume or an external SSD is a separate question; inspect that volume’s own encryption controls. Do not treat the presence of FileVault as evidence that every connected drive is protected.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11On Apple silicon, Apple’s hardware-backed data-protection design handles key management differently from the full-volume model described for Intel Macs. That architecture note does not remove the need to verify settings, maintain account access, or protect recovery information.
External and secondary SSDs need their own check
Make a short inventory of every place sensitive data may reside:
- the Windows or macOS startup volume;
- fixed secondary SSDs inside the computer;
- external SSDs used for projects, backups, or transfers;
- cloned or virtual volumes that may contain older copies; and
- removable media passed between computers.
For each item, record whether encryption is enabled, how it is unlocked, and where the recovery information is stored. If an external SSD is shared between Windows and Mac computers, confirm that the chosen encryption method is supported on every system that must access it. Do not assume that an ordinary external SSD arrives encrypted by default.
Backups deserve special attention. An encrypted laptop with an unencrypted backup SSD still exposes the same documents if the backup is lost. Apply the same coverage review to backup volumes and to old drives retained in a drawer.
Test recovery before a loss occurs
A recovery key that exists but cannot be found is not a practical recovery plan. Test your records without deleting data or intentionally locking yourself out.
Rank #3
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
- Confirm that the recovery key or recovery method is legible and associated with the correct computer and volume.
- Keep the recovery information in a location separate from the encrypted SSD, with access limited to the people who may need it.
- Document which account or administrator is authorized to unlock the drive.
- Review the record after major hardware, firmware, operating-system, or account changes; those events can trigger a recovery request.
- For an organization, store the recovery information in the approved administrative system and test that an authorized administrator can retrieve it.
Do not experiment by wiping keys, changing firmware settings, or removing the drive solely to simulate a failure. The objective is to prove that the recovery information is available, not to create an avoidable lockout.
What to do if the encrypted SSD is lost
- Protect accounts first. From another trusted device, change passwords or revoke sessions that may have been cached on the missing computer.
- Use device-management tools. If the computer was enrolled in an organization’s management system, follow its lost-device procedure, including lock or wipe actions where available.
- Assess whether encryption was actually enabled. Use your recorded volume inventory and status reports. Do not claim that an unverified drive was encrypted.
- Rotate exposed secrets. Replace credentials, tokens, certificates, and keys that may have been stored outside the protected volume or in services that were already signed in.
- Record the incident. Note the device, drives, accounts, and data involved so you can determine whether notification or other obligations apply.
Encryption is most useful here because an offline thief cannot normally read the volume merely by removing the SSD and attaching it elsewhere. It does not prevent data exposure through an already-unlocked session, cloud accounts, unencrypted backups, copied files, or recovery information that was stored with the computer.
Retire, sell, or discard an SSD: choose sanitization separately
When the SSD leaves your control, plan for residual data. Ordinary file deletion, emptying the Recycle Bin or Trash, and quick formatting are not equivalent to sanitization. SSD controllers can remap physical flash cells, so a method suitable for a magnetic hard disk is not automatically suitable for an SSD.
Understand the three sanitization outcomes
| Outcome | Purpose | When it may fit | Important limitation |
|---|---|---|---|
| Clear | Uses logical or device-level operations intended to make ordinary recovery more difficult while leaving the media usable. | Lower-risk reuse when your policy and the SSD’s supported commands allow it. | Not a universal guarantee against all recovery capabilities; confirm the method and assurance required. |
| Purge | Uses a stronger, device-appropriate process intended to make data recovery infeasible with state-of-the-art techniques. | Higher-sensitivity data when the drive will be reused and the model supports an approved purge method. | Implementation depends on the SSD, firmware, controller, and applicable guidance. |
| Destroy | Physically renders the storage media unusable. | When reuse is not required or the sensitivity and policy demand the highest assurance. | The SSD cannot be passed to another owner as a working drive; use an appropriate disposal provider or procedure. |
These categories reflect terminology used in Microsoft’s data-bearing-device procedures and broader media-sanitization practice. They are decision categories, not a universal consumer recipe. Consult the SSD manufacturer’s current instructions and your organization’s policy for the exact command, utility, verification step, and documentation.
Make the retirement decision
- Classify the data. Consider personal information, business records, credentials, regulated data, and whether the SSD ever held recovery keys or unencrypted backups.
- Decide whether reuse is required. Reuse generally points toward an approved clear or purge process; no-reuse situations can justify destruction.
- Identify the exact SSD model. Record its capacity, firmware information, and interface. Supported sanitization commands vary by model and controller.
- Check governing requirements. Use the current method required by your employer, contract, regulator, or disposal provider. A method acceptable for personal low-sensitivity files may be inadequate for confidential records.
- Run the approved process while you still control the drive. Do not hand over an SSD merely because it was encrypted or formatted.
- Verify and document the result. Retain the completion record, serial number, date, method, and disposition when your policy requires evidence.
When the SSD is damaged or inaccessible
If the computer cannot boot or the SSD no longer responds, software sanitization may not be possible. Do not assume that a failed drive is safe: flash memory can retain data even when the operating system cannot mount it. Escalate to a qualified destruction or sanitization provider that can handle SSDs and provide the assurance or certificate your requirements call for.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common mistakes and fixes
“I signed in to Windows, so the SSD must be encrypted.”
Why it fails: A sign-in proves account access, not the encryption state of every volume.
Fix: Open the Device Encryption or BitLocker status page and inspect the specific startup, secondary, and removable volumes.
“FileVault protects my external backup SSD.”
Why it fails: FileVault’s normal target is the Mac startup volume.
Fix: Check and configure encryption for the external backup volume itself, then confirm it remains protected when disconnected and reconnected.
“I can keep the only recovery key on the computer.”
Why it fails: A lost or damaged computer may take the only recovery copy with it. Microsoft warns that unavailable recovery information can make the data unrecoverable.
Rank #4
- The External Hard Drive includes both USB-C and USB-A Cables to make your out-of-box experience great. Ready for any USB-C or USB-A ports on your computer, laptop, or other systems with USB support. Full USB 3.2 Speeds up to 5MBs.
- The desktop hard drive does not require any drivers or software to validate and unlock the drive. Users can use face ID, fingerprint, or remember the password to unlock.
- USB 3.2/3.1.3.0/2.0 compatible with all systems and Operating systems. The computer external backup storage device comes formatted NTFS for windows, but can easily be reformatted for Mac or Linux, or formatted in exFat for universal use.
- Protect your files on the desktop hard drive with the Antivirus SW included on the drive. This is a subscription service and the first year is included. Go online to activate the license.
- Included Splash Proof Pouch to keep your encrypted drive safe when carried. Keep your cables and other accessories with you. Water-resistant and shockproof case. Protect your Portable External Hard Drive when you are on the go.
Fix: Store a protected copy separately, label it clearly, and verify that an authorized person can retrieve it.
Recommended Free Tools
“Formatting the SSD is enough before selling it.”
Why it fails: Formatting changes filesystem structures; it is not the same as media sanitization.
Fix: Select a model-supported clear, purge, or destroy outcome based on the data sensitivity and the receiving party’s requirements.
“Any overwrite-count recommendation works for SSDs.”
Why it fails: SSD controllers and flash translation layers do not behave like magnetic disks, and a universal overwrite count does not establish a universal result.
Fix: Use a current SSD-specific method supported by the manufacturer and applicable policy, or choose destruction when the required assurance cannot be verified.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
“Encryption protects copies I already exported.”
Why it fails: Encryption applies to the protected volume, not automatically to screenshots, email attachments, cloud exports, old backup drives, or files copied to another computer.
Fix: Include every copy and backup in your storage inventory and apply equivalent protection or sanitization.
A practical decision checklist
- Before loss: enable full-volume encryption on the startup SSD and verify the status.
- For each additional drive: identify the volume and confirm whether it is encrypted independently.
- For recovery: preserve the required key or account-based recovery method in a separate, controlled location.
- For a lost computer: secure accounts, invoke management controls, and determine which data and drives were actually covered.
- For retirement: stop treating encryption as the final step; select clear, purge, or destroy according to the SSD model, sensitivity, and policy.
- For evidence: record the drive identity, sanitization method, verification, and final disposition when required.
The reliable sequence is therefore: encrypt while the SSD is in service, verify coverage and recovery, then sanitize separately when the drive is transferred or discarded.
Frequently Asked Questions
Does encrypting an SSD make it safe to sell without sanitizing it?
No. Encryption reduces the risk from an offline thief while the drive remains protected, but a drive leaving your control still needs an appropriate clear, purge, or destroy process for its data and sensitivity.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Will encrypting the Windows system drive automatically encrypt a second SSD?
Not necessarily. Device Encryption and BitLocker coverage can vary by volume, so inspect the secondary SSD’s own status.
What should I do if I cannot find a BitLocker recovery key?
Do not wipe or replace the drive while it still contains needed data. Check the approved account, administrative, or backup locations where the key may have been stored. If no required recovery information exists, Microsoft’s guidance indicates the data may be unrecoverable.
Is FileVault available in the same form on every Mac?
The user-facing FileVault setting differs by macOS version, and Apple describes different underlying protection architectures for Intel and Apple silicon Macs. Verify the setting on the specific Mac and version you use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
