Data Encryption | How to Protect Files on Your Mobile

[Security]

Personal and work data has long been stored not only on computers but also on smartphones, cloud storage, external drives, and backups.

Losing a device or compromising an account can result in the leak of documents, messages, photos, payment information, and access to services.

One of the basic ways to protect such data is encryption. It makes files unreadable to anyone without the key or password. Cyber Media examines how encryption works, what tools are available to users, and what mistakes can lead to loss of access to your data.

Why encryption has become a basic data​

For the average user, encryption most often becomes relevant when a device is lost or stolen. But in practice, it's important to think about protection in advance. A smartphone or laptop can store more sensitive information than a paper document folder: passport scans, email access, work files, document photos, payment history, and correspondence.

If the drive isn't encrypted, an account password isn't always sufficient. An attacker can try to remove the drive, connect it to another device, and access the files directly. Full-disk encryption prevents this scenario: data remains unreadable without the key, even if the physical drive ends up in someone else's hands.

However, encryption doesn't solve all security issues. It doesn't replace backups, antivirus protection, system updates, or vigilance against phishing emails. If malware is already running on an unlocked system, it can access files just like the user.

Users perceive data encryption using built-in tools as a crucial step in ensuring their own security. Unfortunately, attackers share this view—ransomware attacks have remained the most destructive for businesses and end users for over five years. This means that a built-in application, designed with legitimate functionality, begins to operate in a less-than-legitimate manner, ranging from protecting the user to rendering them completely helpless when attempting to access files.

Therefore, it's important to distinguish between legitimate encryption and ransomware attacks. In the former case, the key is held by the data owner. In the latter, it's held by the attackers, who block access and demand a ransom. Defense against such attacks relies not only on disk encryption but also on backups, access control, and general digital hygiene.

How encryption works and what threats does it protect against?​

Encryption is the process of converting information into an unreadable form using a cryptographic algorithm and key. As long as the user has the correct key—a password, PIN, recovery key, or hardware module—the data can be opened and used. To an outsider, these same files appear as a meaningless string of characters.

In everyday scenarios, the user typically doesn't need to manually select an algorithm or key length. Modern operating systems and trusted applications do this automatically. The user's primary task is to enable protection, set a strong password, and store the recovery key.

Encryption is particularly useful in three situations:

• in case of loss or theft of a smartphone;
• if a laptop or external drive is stolen;
• when storing sensitive files in the cloud or on removable media.

It's important to understand the limits of this protection. Encryption helps when an attacker has gained physical access to a device or drive but doesn't know the password. However, it doesn't protect against attacks if the user has shared the password with the attackers, installed malware, or is working on an already compromised system.

Encryption on smartphones: iOS and Android​

Modern smartphones have encryption built into the operating system. Users don't need to install any additional software: simply enable a screen lock and use a strong passcode.

In practice, smartphone security starts with simple steps: setting a non-obvious PIN or password, enabling automatic lock, setting up biometrics, and hiding sensitive notification content on the lock screen. Biometrics speeds up unlocking, but doesn't completely replace the passcode: after a reboot or for certain sensitive operations, the system will still request it.

A simple example with a mobile OS is using a password. Yes, a simple password, but the system automatically encrypts everything and prevents access. Android even has two technical terms: BFU/AFU (before/after first unlock). Simply put, in BFU (before first unlock) mode, the phone is essentially a brick: the system is booted, but all user data is securely encrypted. As soon as you enter the coveted password, it switches to AFU (after first unlock) mode, and the system gains full access to your files.

For iOS, the principle is similar: data protection is tied to the passcode and the device's hardware. On Android, much depends on the OS version and manufacturer, but the general approach is the same: enabling the screen lock activates the device's built-in data protection mechanisms.

Here's what you need to do on your smartphone:

• use a long PIN or alphanumeric password instead of simple combinations;
• Enable Face ID, Touch ID, or fingerprint scanner as an additional convenient login method;
• set up automatic screen lock;
• hide SMS, email, and push notification text on the lock screen;
• enable the device search function;
• Before selling or giving away your phone, perform a full reset to factory settings.

Simply deleting apps and photos before selling isn't enough. The correct course of action is to back up, sign out of all accounts, and perform a full reset of the device.

How to enable encryption on your PC: Windows and macOS​

Encryption is especially important on computers because the drive can be removed from the device or read using an external boot system. Account passwords and disk encryption are different levels of protection. The former restricts login, while the latter protects the data on the drive itself.
In Windows, BitLocker or device encryption is used to protect the drive. In macOS, FileVault is used. For most users, these built-in tools are sufficient: they run silently in the background and require no complex setup.

In the case of Windows, everything is extremely simple and has long been tested by both users and the aforementioned attackers, namely the well-known BitLocker. For Windows, this built-in tool has an undeniable advantage: it supports legacy builds and is covered by detailed, standardized operating system logs. With macOS, everything is absolutely similar, except that hardware encryption has been developed for modern Apple Silicon processors using the built-in FileVault.

Before enabling full encryption, it's a good idea to back up important data. The process itself usually proceeds normally, but a power failure, drive error, or loss of the recovery key can make accessing your data difficult.

For the average user, enabling and configuring built-in encryption is quite simple: on all modern PCs and smartphones, it works on the principle of "enable, save the recovery key, and run."

For Windows, the general approach is to open the Control Panel, go to System and Security, select BitLocker Drive Encryption, and enable protection for the desired drive. It's important to keep the recovery key separate from your computer.

For macOS , open System Preferences, go to Privacy and Security, find FileVault, and enable it. The system will prompt you to select a recovery method—this step is essential.

If the device is company-owned, the encryption settings may be configured by the IT administrator. In this case, you should not disable protection or change settings without permission.

Built-in tools or third-party programs​

Built-in tools are well-suited for protecting the entire device. BitLocker and FileVault are convenient because they operate transparently: after setup, the user continues to use the computer as usual, while encryption occurs in the background.

Third-party solutions are needed when the task goes beyond full-disk encryption. For example, you need to protect a specific folder, create an encrypted container, transfer files between different operating systems, or pre-encrypt documents before uploading them to the cloud.

AES-256 is certainly the "gold standard" of symmetric encryption, easy to use at the application level, yet mathematically complex internally, with high resistance to brute force attacks and known cryptanalytic methods.

When choosing a solution, it's important to consider not only the stated algorithm but also the product's reputation, regular updates, ease of access recovery, and clear settings. For the average user, a strong password and proper key storage are often more important than manually selecting the "strongest" encryption mode.

Scenario	What will do?
Protect your entire laptop or system drive	BitLocker, FileVault, or native device encryption
Encrypt a specific set of files	Encrypted container or specialized program
Store sensitive files in the cloud	Client-side encryption before download
Work with files on different operating systems	Cross-platform tool
Protect a flash drive or external drive	Encrypting a removable drive or container
Manage security in the company	Centralized policies, key accounting, and backups

An overly complex scheme can be harmful: if the tool is inconvenient, the user will begin to bypass protection, store the password next to files, or stop using encryption altogether.

Encrypt files before uploading to the cloud​

Cloud storage is convenient for synchronization and backup, but it's best not to upload sensitive documents there in clear text. Even if a service protects data during transmission and storage, this doesn't always mean that the user controls the keys.

It's important to distinguish between provider-side encryption and user-side encryption. In the former case, the data is protected by the cloud service. In the latter, the file is encrypted before uploading, and the provider receives only an unreadable set of data.

The only way to guarantee file security in the cloud without trusting the provider is through user-side encryption before uploading. The provider only receives encrypted data and does not know the keys.

This approach is especially important for document scans, financial files, medical data, work archives, backups, and any information whose leak could have serious consequences.

For less sensitive materials, standard account protection may be sufficient: a strong password, two-factor authentication, and control over connected devices. However, the higher the cost of a leak, the more sense it makes to encrypt the data before uploading.

How to maintain access to encrypted data​

Strong encryption doesn't provide a "back-up" option for the owner if they forget their password or lose their recovery key. This is both the technology's strength and its main risk: an unauthorized person can't bypass the protection, but the user also won't be able to regain access without pre-prepared recovery tools.

If you forget the password to your encrypted files and don't have a pre-prepared recovery key, restoring access to the data is virtually impossible; cryptography leaves no "backup" entry. Therefore, security and accessibility are determined not by hacking methods, but by organizing backup access.

The recovery key must be accessible to the owner, but not accessible to others. It must not be stored in a text file on the same encrypted laptop or photographed and left unprotected in the smartphone's gallery.

Rules of thumb:

• Save the recovery key immediately during setup;
• keep it separate from the device;
• do not keep the only copy of the key in one place;
• use a password manager for complex passwords;
• Check regularly that backups actually open;
• For important data, use the "3-2-1" rule: three copies, two different types of media, one copy off the primary device.

For corporate environments, these rules are supplemented by centralized key storage, access rights delimitation, and regular testing of recovery procedures.

Common mistakes when working with encrypted disks​

Most encryption issues stem not from cryptography but from user habits. Protection is enabled, but the recovery key isn't saved. The password is complex, but it's written down on a sticky note next to the laptop. Files are encrypted, but there are no backups.

Based on experience, most problems with "hiding" and encrypting files are not related to cryptography, but to poor habits: keys are lost, stored next to data, and passwords are written on paper. The main rules for the secure use of encrypted containers and disks are based on several principles: reliable tools, proper configuration, key protection, and backup access.

The most common mistakes:

• enable encryption and do not save the recovery key;
• keep the password close to your device;
• use one password for disk, mail and cloud;
• confuse encryption with backup;
• upload sensitive files to the cloud without client-side encryption;
• do not check for recovery;
• disable encryption for convenience;
• transfer or sell the device without a full reset.

It's important to remember that encryption doesn't protect against all attacks. If a user reveals their password to a scammer or runs malware on an unlocked system, the encrypted drive is no longer a barrier. Therefore, technical protection must be complemented by vigilance and basic digital hygiene.

Conclusion​

Encryption isn't a universal defense against all cyberthreats, but it's an important basic barrier if your device is lost, your drive is stolen, or you store sensitive files in the cloud. For most users, built-in tools are sufficient: a passcode on your smartphone, BitLocker in Windows, and FileVault in macOS.

The key is not only enabling encryption but also properly storing recovery keys, using strong passwords, and making backups. These habits help you maintain control over your data and prevent security from becoming a risk of loss.