Picture the moment a laptop gets confiscated. Maybe it's a border crossing, maybe it's something worse. The device leaves your hands, and your stomach drops, because surely everything on it just left with it.
It didn't. Not if your encryption was set up correctly.
That gap between owning a device and owning its data is the whole game, and most people have never thought carefully about why it exists.
The lock is not on the box
A well-encrypted drive is less like a locked safe and more like a block of poured concrete with a diamond sealed inside: having the concrete is almost beside the point. You need a specific drill, and the drill only works with one combination.
When a modern device uses full-disk encryption (FileVault on a Mac, BitLocker on Windows, the default on a current iPhone), every bit stored on the drive is mathematically scrambled using a cipher like AES-256. The scrambling is tied to a key derived from your passphrase, your biometrics, or both. Without that key, the raw data on the storage chip is noise. Literal, useless noise.
Here's the concrete mechanism. A forensics team seizes a laptop and removes the SSD entirely, slotting it into their own machine. What they see is not your files. They see ciphertext: billions of scrambled characters that look nothing like a spreadsheet or a photo. File structure, filenames, contents, all of it is indistinguishable from random data. No key, no plaintext. That's not a policy or a promise. It's arithmetic.
What actually determines whether it holds
The protection isn't magic. It depends on specific conditions, and this is where most people's understanding goes soft.
The device has to have been locked or powered off at the moment of seizure. A phone or laptop that was running and unlocked may have the decryption key loaded in active memory (RAM). Forensics tools can sometimes extract a key from RAM or from a hibernation file. Powered off, or locked with the key flushed from memory, is a fundamentally different situation. Not a minor detail.
The passphrase also has to be strong enough to resist brute force. A six-digit PIN on an iPhone gets approximately ten attempts before the device wipes itself (with that setting enabled). A seventeen-character alphanumeric passphrase on an encrypted laptop buys years of computational time against even well-resourced attackers, because AES-256 with a strong key derivation function like PBKDF2 or Argon2 makes each guess genuinely expensive.
And the encryption has to actually be on. This sounds obvious. It isn't. An Android phone that's never been updated may have had encryption disabled by default, or enabled in a weaker software-only mode. A Windows machine with BitLocker might have its recovery key automatically saved to a Microsoft account, which is a separate attack surface entirely.
Take two colleagues who bought the same phone model on the same day. One set a strong alphanumeric passphrase and enabled auto-wipe after ten failed attempts. The other kept the default six-digit PIN. Same hardware, same encryption chip, completely different exposure if that device ends up in unfamiliar hands.
What people consistently miscalculate
The biggest misconception is conflating physical access with data access. They are not the same thing. The entire point of device encryption is to sever that link, and it does sever it, decisively, when the conditions above are met.
The second is about cloud backups, and this one genuinely frustrates me. Encrypting a device does nothing to protect data that's been automatically synced to a cloud account with a weak password and no two-factor authentication. The encrypted local copy is a vault. The cloud backup sitting behind a recoverable password is a different door, one that doesn't require touching your hardware at all. These are not the same threat.
Then there's biometrics. People assume that because their device has a fingerprint scanner, they have strong encryption. They don't, exactly. Biometrics are authentication, not encryption. They're a convenient way to unlock the key. The key itself does the actual work. Here's the part worth knowing: in some jurisdictions, courts can compel a fingerprint but not a passphrase, because biometrics have weaker legal protections than something you've memorized. The biometric becomes the weak link, not the cipher.
So, are you actually sure your encryption is on? On an iPhone, go to Settings and scroll to the very bottom: "Data Protection is enabled" means you're using hardware-level encryption. On a Mac, check Security and Privacy for FileVault status. If it's active, with a strong passphrase and auto-lock enabled, your data is genuinely, mathematically protected from physical seizure in a way that was essentially impossible for ordinary people to achieve two decades ago.
The device being gone and the data being gone are different events. Cryptography made them separable. Whether yours actually are is a settings question, not a hardware one.