Study Guide
Data States and Encryption at Rest
Data at rest, in transit and in use, and why each needs its own protection; then the levels at which stored data is encrypted: full-disk, partition, volume and file encryption, BitLocker and EFS, self-encrypting drives, and database and record-level encryption, with what each one leaves exposed.
Lesson 6.8 Cryptography & PKI
Encryption can protect data where it is stored, but “encrypted” covers very different things. This lesson works out which states data can be in, which levels of encryption protect stored data, and which threat each level answers.
Stage: Think
One pupil record
Think it through
Think of one pupil’s record: stored in the school’s database, sent to an administrator’s browser, then shown on her screen. Where could someone get at it, and would the same protection cover all three?
- Hint 1: Follow the record from the disk to the screen.
Show what happens
On the server’s disks, on the network on its way, and on the screen or in memory while it is used. Each of those needs its own protection; protecting one does not protect the others.
Think it through
Show the answer
Answer: C. Yes, until the screen locks.
Yes, until the screen locks: the drive was already unlocked, so its encryption is not protecting anything at that moment.
Stage: Explain
The three states of data
At any moment, a piece of data is in one of three states.
| State | Meaning | Examples | Typical protection |
|---|---|---|---|
| Data at rest | Stored, and not currently moving or being processed | Files on a laptop’s drive, a database on a server, backups, a USB stick | Disk, file or database encryption |
| Data in transit | Moving across a network | A web form being submitted, an email being delivered, a file being copied to a server | Transport encryption such as TLS |
| Data in use | Loaded in memory and being processed | A document open on screen, a record an application is calculating with | Access control, memory protection, secure enclaves |
“Data in transit” is also called data in motion.
Each state needs its own protection, and protecting one does not protect the others. A file on an encrypted disk is decrypted when it is read; if it is then sent over the network without transport encryption, it travels in the clear. A record that arrives over an encrypted connection is plain data once the application has it in memory.
An office administrator at a fictional school opens a pupil’s record.
- At rest. The record is held in the school’s pupil database, on a server whose disks are encrypted.
- In transit. The administrator’s browser requests it. The record travels from the server to the browser over HTTPS.
- In use. The browser holds the record in memory and shows it on screen. It is not encrypted there, and anyone looking over the administrator’s shoulder can read it.
Three states, three different protections, and a gap anywhere exposes the record.
Check your understanding
Show the answer
Answer: B. In use
In use: it is in memory and on screen, and not encrypted there.
Data in use is the hardest state to protect, because a processor ordinarily needs data in plain form to work on it. Access control, locking screens and limiting what software may run do most of the work. Secure enclaves are a hardware answer for the most sensitive cases.
The rest of this lesson is about data at rest. Data in transit is the subject of the next lesson.
Stage: Predict
Levels of encryption for data at rest
Stored data can be encrypted at several levels. The higher the level in this table, the more it covers and the less it distinguishes between users.
| Level | What is encrypted | Protects against | Does not protect against |
|---|---|---|---|
| Full-disk | The whole drive, including the operating system | Loss or theft of the powered-off device or drive | Anyone or anything using the device once it is unlocked |
| Partition or volume | One partition or logical volume of a drive | Loss or theft, for that area only | Access once that volume is unlocked; data on other volumes |
| File | Individual files or folders, often tied to one user | Other users of the same computer; copies of the file taken elsewhere | Malware running as the signed-in user |
| Database | The database’s stored files and backups | Theft of the files, disks or backups | Any account or application authorised to query the database |
| Record or column | Particular rows or fields within a database | Database users and administrators who lack the key | Whoever holds that key, and the application that uses it |
Think it through
A letter inside an envelope, inside a locked cabinet, inside a locked room. Once the room is open but the cabinet is still locked, who can read the letter? What does that suggest about layers of encryption?
- Hint 1: Which lock still stands in the way?
Show what happens
Only someone with the cabinet key. Each layer protects against different people, which is why encryption at different levels is used together.
The levels sit inside one another, like a letter inside an envelope inside a locked cabinet inside a locked room. The diagram shows the nesting, and who can still read a pupil’s record when each level is the only one in use.
Read from the outside in. Each box names a level and says who can still read a pupil’s record if that level is the only encryption in use. The further in, the fewer people that is.
Full-disk encryption
Locks the whole drive. Once the computer is switched on and unlocked, anyone or anything signed in can read the record.
Partition or volume encryption
Locks one area of the drive. Once that area is unlocked, the same is true for everything in it.
File encryption
Locks particular files, usually for one user. Other users of the computer cannot read them; programs running as that user can.
Database encryption
Locks the database’s files and backups. Any account or application allowed to query the database still reads the record.
NarrowestRecord or column encryption
Locks one field, such as the medical notes. Even a database administrator cannot read it without that field’s key.
The levels are not alternatives. A school laptop might use the outermost, and the school’s records system the two innermost, each covering what the others leave open.
Stage: Predict
Full-disk encryption
Full-disk encryption (FDE) encrypts everything on a drive. Before the operating system starts, a key must be released, by a TPM, a PIN, a password or a combination. From then on, encryption and decryption happen automatically and invisibly.
FDE answers one question very well: what if a teacher’s laptop is left on a train? Without the key, the drive is unreadable, even if it is removed and connected to another computer.
Think it through
Show the answer
Answer: B. switched off.
Switched off, or locked at the start-up prompt. Once it is unlocked, the drive reads as normal.
It is important to be exact about its limit. Full-disk encryption protects a device that is switched off or locked at the pre-start prompt. Once the device is unlocked and running, the data is available to whoever, or whatever, is signed in. It does nothing against malware on a running machine, an attacker with the user’s password, or a thief who takes the laptop while it is on and unlocked.
A teacher at a fictional school carries a laptop that holds pupils’ reports. Its drive uses full-disk encryption.
- Left on a train, switched off. Whoever finds it meets the unlock prompt. Without the key the drive is unreadable, even if it is taken out and connected to another computer. The school has lost a laptop, not the reports.
- Taken from a café table, open and signed in. The drive is already unlocked, so the thief can read every report until the screen locks. Full-disk encryption did nothing here. A short screen-lock time, and the habit of locking the screen before looking away, would have.
The encryption was the same on both days. What changed was whether the device was unlocked.
Check your understanding
Show the answer
Answer: B. It was unlocked.
The laptop was signed in, so the drive was already unlocked.
Partition and volume encryption
A physical drive can be divided into partitions, and a volume is a storage area that the operating system treats as one drive, such as C:. Partition encryption, or volume encryption, protects that one area and leaves the rest alone. It is used, for example, to encrypt a data volume separately from the system volume, or an external drive.
In everyday speech “full-disk” and “volume” encryption are often used for the same products, because encrypting every volume on a disk amounts to encrypting the disk.
Stage: Predict
File-level encryption
- Hint 1: Who unlocked the disk, and for whom?
Show what happens
Yes, once the disk is unlocked, unless the files themselves are encrypted for each user. Encrypting files with each person’s own key does that.
File-level encryption protects individual files or folders. Its advantage is precision: each user’s files can be encrypted with that user’s own key, so two people sharing one computer cannot read each other’s protected files, and an encrypted file stays encrypted when it is copied to a USB stick or attached to an email.
Its weakness is that it protects only what someone remembered to encrypt, and it reveals more: file names, sizes and temporary copies may be left unprotected.
Full-disk and file-level encryption are not alternatives. They defend against different things and are often used together.
Stage: Explain
BitLocker and EFS
Windows includes one example of each.
BitLocker encrypts whole volumes. It uses AES and is designed to work with the computer’s TPM, which releases the key only if the computer starts in its expected state; a PIN can be required as well. If the TPM will not release the key, for example after a hardware change, a 48-digit recovery key unlocks the drive. Organisations store those recovery keys centrally, which is key escrow in practice.
The Encrypting File System (EFS) encrypts individual files and folders on behalf of a user account. It is a small example of hybrid encryption: each file is encrypted with its own symmetric key, and that key is encrypted with the user’s public key and stored with the file. Only someone signed in as that user, holding the matching private key, can open it.
Check your understanding
Show the answer
Answer: C. BitLocker
BitLocker encrypts whole volumes; EFS encrypts files and folders for a user account.
Do not confuse: BitLocker and EFS
- LevelBitLocker
- Whole volumes. Protects the device when it is off. Tied to the computer, usually through its TPM.A stolen laptop’s drive cannot be read.
- LevelEFS
- Individual files and folders. Protects one user’s files from other users. Tied to a user account.A colleague sharing the PC cannot open the file.
Stage: Predict
Self-encrypting drives
A self-encrypting drive (SED) does the encryption itself, in hardware built into the drive. Everything written to it is encrypted by the drive’s own controller with a key held inside the drive, and the computer simply reads and writes as usual.
Think it through
Show the answer
Answer: A. Not until set up.
Not until it is set up to require authentication before it unlocks.
- Advantages: no work for the computer’s processor, nothing to install, and it works with any operating system. Because all data is encrypted with one internal key, destroying that key makes the whole drive unreadable in an instant, which is a quick way to wipe a drive before disposal.
- Cautions: the drive is encrypting from the start, but it is not protected until it is set up to require authentication before it unlocks. And the protection is only as good as the drive maker’s implementation, which the buyer cannot inspect. In 2018, researchers found serious flaws in the encryption of several widely sold models, and Windows subsequently stopped relying on a drive’s own encryption by default.
Stage: Predict
Database and record-level encryption
Databases hold an organisation’s most concentrated data, and they can be encrypted in more than one way.
Think it through
Show the answer
Answer: C. Plain data.
The data in plain form: the running database decrypts as it reads, so encryption on disk does not stop her.
Whole-database encryption
The database system encrypts its data files, log files and backups as it writes them and decrypts as it reads. Applications need no changes, which is why this is often called transparent encryption.
It protects against someone stealing the database files, the server’s disks or a backup tape. It does not protect against anyone who connects to the running database with an authorised account: the database decrypts for them automatically. That includes a database administrator, and an attacker who has stolen an application’s database password.
Column and record-level encryption
Here, particular columns (the medical-notes field of every pupil) or particular records (one pupil’s safeguarding file) are encrypted with keys the database itself does not freely hold. The application, or an authorised user, supplies the key. This is column-level or record-level encryption.
Now a database administrator who runs a query sees ciphertext in the protected fields. The data is protected from people with legitimate access to the database who have no need to see the content.
The cost is complexity. Encrypted fields are hard to search and sort, the application must manage keys, and performance suffers. So it is used selectively, for the fields that most need it.
Check your understanding
Show the answer
Answer: B. Column-level encryption
Column-level encryption of the safeguarding-notes field, with keys the database itself does not hold.
A fictional school reviews how it protects pupil and staff records.
- Risk: a teacher’s laptop is left on a train. Answer: full-disk encryption on every laptop. The finder gets hardware and nothing else.
- Risk: office staff share one PC, and the business manager keeps staff HR notes on it. Answer: file-level encryption tied to the business manager’s account.
- Risk: backups of the pupil database go to an outside storage provider. Answer: whole-database encryption, which covers the backups.
- Risk: the database administrator, who needs to maintain the system, could read every safeguarding note. Answer: column-level encryption of the safeguarding-notes field, with the key held by the safeguarding application and not by the administrator.
No single level answers all four. Each was matched to a threat.
Stage: Explain
Security+ terminology
The CompTIA Security+ SY0-701 exam objectives (objective 1.4) list under Encryption, Level: full-disk, partition, file, volume, database and record. Objective 3.3 lists the data states: data at rest, data in transit and data in use.
The objectives do not name BitLocker, EFS or self-encrypting drives; they are common examples of the listed levels.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
Show the answer
Answer: C. Whole-database encryption
Whole-database encryption, which encrypts data files, logs and backups as they are written.
Apply it
Show the answer
Answer: A. Not by disk encryption.
Not by disk encryption: the file was decrypted when read and is now in transit, which needs its own protection.
Apply it
Show the answer
Answer: B. Full-disk encryption
Full-disk encryption: the finder gets the hardware and nothing else.
Stage: Check
Check your understanding
These questions come from the approved revision bank. They were approved under owner-authorised delegated review: the site owner authorised the review and did not read each question individually.
Show answer
Answer: Data in use
Data at rest is stored, data in transit is moving across a network, and data in use is being processed in memory. A record loaded into memory for a calculation is in use. A backup is one form of data at rest, not a state of its own.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Data States and Encryption at Rest (Supplementary Study Guide explanation)
Show answer
Answer: Last month’s backups held on tape; A spreadsheet saved on a USB stick
Data at rest is stored, data in transit is moving across a network, and data in use is being processed in memory. The saved spreadsheet and the backup tapes are stored. The web form is in transit while it is being submitted, and the report being edited is in use.
Revision sources: Data States and Encryption at Rest (Supplementary Study Guide explanation)
Show answer
Answer: False
False. Each state of data needs its own protection, and encrypting one state does not protect the others. Disk encryption protects files at rest. Once a file is read and sent to a user it is in transit, and it needs transport encryption to be protected there.
Revision sources: Data States and Encryption at Rest (Supplementary Study Guide explanation)
Show answer
Answer: The report is exposed in transit: disk encryption covers data at rest
Each state of data needs its own protection, and encrypting one state does not protect the others. Disk encryption protects the report while it is stored on the server. Once the report is read and sent to the teacher it is in transit, where transport encryption would be needed to protect it. Opening one file does not remove the disk’s encryption, and disk encryption does nothing for data that is being processed in memory.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Data States and Encryption at Rest (Supplementary Study Guide explanation)
Show answer
Answer: Very little: the volume is unlocked, so the files are readable
Full-disk encryption protects a drive against loss or theft of the powered-off device, but once the device is unlocked and running, the data is available to whoever or whatever is signed in. The thief is using an unlocked volume, so no key or recovery key is asked for, and the protection does not depend on which files were opened recently.
Revision sources: Data States and Encryption at Rest (Supplementary Study Guide explanation)
Show answer
Answer: Full-disk covers the whole drive; file-level protects chosen files and can differ per user
Full-disk encryption protects everything on a drive, while file-level encryption protects chosen files and can differ for each user. Both protect data at rest, not data in transit or in use; full-disk encryption does not hide data from whoever is signed in, and file-level encryption can keep one user’s files from another.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Data States and Encryption at Rest (Supplementary Study Guide explanation)
Show answer
Answer: The pupil-records volume, but not the system volume
Partition and volume encryption protect one area of a drive, so the theft of the powered-off server exposes the unencrypted system volume and not the pupil records. Full-disk encryption would have covered the whole drive. Encrypting chosen files for each user is file-level encryption, and data moving across a network is in a different state, which needs its own protection.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Data States and Encryption at Rest (Supplementary Study Guide explanation)
Show answer
Answer: BitLocker encrypts whole volumes; EFS encrypts individual files for a user
BitLocker encrypts whole volumes in Windows and the Encrypting File System (EFS) encrypts individual files for a user account. The two work at different levels and can be used together. Encryption carried out in a drive’s own hardware describes a self-encrypting drive, and neither feature protects files while they travel across a network.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Data States and Encryption at Rest (Supplementary Study Guide explanation)
Show answer
Answer: The drive’s own hardware performs the encryption
A self-encrypting drive performs the encryption in the drive’s own hardware, so the operating system reads and writes as usual. Encrypting each file separately is file-level encryption carried out by software, a drive holds data at rest, and its encryption key is held inside the drive itself.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Data States and Encryption at Rest (Supplementary Study Guide explanation)
Show answer
Answer: Encrypt the diagnosis records or column with a key the administrator lacks
Whole-database encryption does not hide data from an account or application that is authorised to query it, while record-level and column-level encryption can keep specific data from database users and administrators who lack the key. More encryption of the stored files, or of the connection, still leaves the query returning readable diagnoses.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Data States and Encryption at Rest (Supplementary Study Guide explanation)
Study and revision
Practise through the Cryptography & Data Protection topic. Questions cover classifying data by state, why protecting one state does not protect another, what full-disk encryption does and does not protect, full-disk against file-level encryption, what volume encryption covers, BitLocker and EFS, self-encrypting drives and record-level encryption; five flashcards recall the main points. Most are learning-only. The questions that have been verified against CompTIA Security+ SY0-701 objectives 1.4 and 3.3 are also in the Security+ practice track; that does not mean the lesson covers the whole of an objective, and the lesson does not establish practical experience.
Stage: Consolidate
What to remember
- Data is at rest, in transit or in use; each state needs its own protection.
- Full-disk encryption protects a device that is off or locked, not one that is unlocked and in use.
- File-level encryption separates users; volume, partition and self-encrypting drives protect whole storage.
- Whole-database encryption protects files and backups; column or record encryption protects fields from people with database access.
- Match each level to a threat; layers are used together.
Key terms
- Data at rest
Data that is stored, and not currently moving or being processed.
- Data in transit
Data that is moving across a network.
- Data in use
Data that is loaded in memory and being processed.
- Full-disk encryption (FDE)
Encryption of everything on a drive, including the operating system.
- BitLocker
The Windows feature that encrypts whole volumes, normally using the computer’s TPM to release the key at start-up.
- Self-encrypting drive (SED)
A drive that encrypts everything written to it in its own hardware, with a key held inside the drive.
- Database encryption
Encryption of a database’s stored files and backups by the database system, which decrypts automatically for every authorised connection.
Common misunderstandings
It is safe from someone who finds the laptop switched off. It is not protected from malware, or from anyone using the laptop while it is unlocked.
Whole-database encryption decrypts for every authorised connection. Keeping data from administrators needs column or record-level encryption with a key they do not hold.
Disk encryption covers data at rest. Data in transit needs transport encryption.
BitLocker encrypts volumes and protects a device that is off. EFS encrypts chosen files for one user account.
Further reading
- Microsoft Learn: BitLocker overview: what BitLocker protects, how it uses the TPM and its requirements.
- Microsoft Learn: BitLocker FAQ: includes how BitLocker and EFS can be used together.
- NCSC: Device Security Guidance: the UK National Cyber Security Centre’s advice on protecting data on devices.
- NIST SP 800-111: Guide to Storage Encryption Technologies for End User Devices: full-disk, volume and file encryption compared.
- CompTIA Security+ SY0-701 exam objectives (PDF): objectives 1.4 and 3.3.
Lesson sources and acknowledgements
Sources and scope
- Covered in Session 9 (see the Session 9 Learning Log): confidentiality and data at rest, in transit and in use; full-disk and partition encryption, BitLocker and EFS, and self-encrypting drives; and database and record-level encryption.
- Accuracy qualifications: full-disk encryption does not protect a device that is unlocked and running; whole-database encryption does not hide data from an account authorised to query it; encrypting one state of data does not protect the others.
- Independently checked: BitLocker’s use of volumes, AES, the TPM and recovery keys, and its relationship to EFS, against Microsoft’s BitLocker documentation; the data states and encryption levels against the published SY0-701 objectives. These are external references, not course evidence.
- Supplementary explanation: every definition, the tables of states and levels, the pupil-record example, what each level does and does not protect, the lost-laptop example, the description of EFS as hybrid encryption, the advantages and cautions of self-encrypting drives, transparent and column-level database encryption, the school’s choice of levels, the nested diagram of the five levels and the misunderstandings. These were developed afterwards and are my explanations, not the tutor’s words. The diagram is original.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the opening questions about one pupil record and a café laptop, every question asked in the lesson with its feedback and hints, the application questions and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. The school, its staff and its records are fictional. The lesson material has an associated lab on storage encryption; I do not record it as completed, and I have not configured BitLocker, EFS, a self-encrypting drive or database encryption as part of this lesson.
The standard symmetric block cipher, with 128-, 192- or 256-bit keys.
Establishing or verifying a claimed identity, for example when a user signs in.
The Windows feature that encrypts whole volumes, normally using the computer’s TPM to release the key at start-up.
Data after encryption: unreadable without the key that decrypts it.
Data that is stored, and not currently moving or being processed.
Data that is moving across a network.
Data that is loaded in memory and being processed.
Encryption of a database’s stored files and backups by the database system, which decrypts automatically for every authorised connection.
Turning ciphertext back into plaintext, using the correct key.
The Windows feature that encrypts individual files and folders on behalf of a user account.
Transforming data with a cipher and a key so that it cannot be read without the right key. Decryption reverses it.
Encryption of chosen files or folders, often with a key tied to one user, so that other users of the same computer cannot read them.
Encryption of everything on a drive, including the operating system.
HTTP protected by TLS. HTTP/1.1 and HTTP/2 commonly use TCP port 443, while HTTP/3 uses QUIC over UDP port 443.
Malicious software designed to disrupt, damage or gain unauthorised access to devices, networks or data. Ransomware is one type.
The software that runs a computer and lets other programs use it. Windows, macOS, Linux, Android and iOS are operating systems.
Encryption of one partition or volume of a drive, leaving the rest of the drive as it was.
The half of a key pair that its owner keeps secret. It decrypts data sent to the owner and creates the owner’s signatures.
The half of a key pair that can be given to anyone. It encrypts data for the key’s owner and verifies the owner’s signatures.
Encryption of particular records or columns in a database, with a key that the database’s ordinary users and administrators do not hold.
A separate key that unlocks an encrypted drive when the normal method cannot, for example after a hardware change. BitLocker’s is a 48-digit number.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
An isolated, protected area of a processor or system-on-chip that keeps keys and sensitive processing apart from the main operating system.
A drive that encrypts everything written to it in its own hardware, with a key held inside the drive.
A potential cause of harm, such as an attacker seeking unauthorised access.
A protocol that protects data in transit with encryption for confidentiality and with integrity protection, and authenticates the server when certificate validation succeeds. HTTPS uses it to secure web traffic.
A security chip built into one device that generates and protects keys for that device, and can release them only when the device starts in an expected state.
Encryption that protects data while it travels between two endpoints, so that anyone in between can neither read it nor change it unnoticed.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.