I recently realized that the C: drive in my custom-built PC is not encrypted, and I'd like to protect my files if the computer is lost or stolen. The system uses a Kingston NV2 1TB SSD, a Gigabyte B650M Gaming Plus WiFi motherboard, and a Ryzen 7 7800X3D processor. I'm running Windows and was told to enable Secure Boot and AMD fTPM in the BIOS so that Windows encryption options appear. Will those settings actually encrypt the drive, or do I need to enable BitLocker separately? Will the drive automatically unlock when I sign in, and is there any meaningful risk of losing data while changing these settings?
2 Answers
Before enabling encryption, make a complete backup and verify that you can restore important files. Most systems will unlock automatically through the TPM during normal startup, but your usual Windows login password or PIN is not the same thing as the BitLocker recovery key. Save or print that recovery key and keep it somewhere separate from the computer. You’ll need it if the motherboard, boot configuration, or TPM state changes.
Secure Boot and AMD fTPM are prerequisites or supporting features, but changing them does not encrypt the drive by itself. On a modern AM5 system, fTPM is often already enabled. Search Windows for “BitLocker” or “Device encryption” and check the current status before changing anything. Windows Home may provide Device Encryption, while Pro editions generally expose the full BitLocker controls.
So the BIOS settings mainly allow Windows to use the TPM, and the actual encryption still has to be enabled from Windows?