How to encrypt USB drive

Summary

This guide helps you troubleshoot and resolve: How to encrypt USB drive. Follow the steps below to fix the issue.

Common Causes

Why encrypt your USB drive?

• Protects confidential data if the USB drive is lost or stolen
• Required by many company security policies
• Prevents unauthorised access to business files

Method 1: Use BitLocker To Go (recommended for Windows 11)

Check if BitLocker is available

1. Insert the USB drive into an available USB port.
2. Open File Explorer and select This PC from the left navigation pane.
3. Right-click the USB drive under Devices and drives.
4. If you see Turn on BitLocker in the context menu, the feature is available.
5. If the option is missing, your edition of Windows may not support BitLocker To Go, or a Group Policy may be blocking it. Contact IT via Open a Ticket.

Encrypt the USB drive with BitLocker

1. Right-click the USB drive in File Explorer and select Turn on BitLocker.
2. In the BitLocker Drive Encryption window, select Use a password to unlock the drive.
3. Enter a strong password that meets the company password policy requirements, then click Next.
4. Choose how to save your recovery key: select Save to your Microsoft account, Save to a file, or Print the recovery key. Store the key in a secure location separate from the USB drive, then click Next.
5. Select Encrypt entire drive for maximum security, then click Next.
6. Choose Compatible mode if the drive will be used on older versions of Windows, then click Next.
7. Click Start encrypting. Do not remove the USB drive or shut down the computer until the process completes.

Using the encrypted USB drive

1. Insert the USB drive into any company computer running Windows.
2. Open File Explorer and double-click the USB drive.
3. Enter the password when prompted by the BitLocker unlock dialog.
4. Click Unlock to access your files normally.

Troubleshooting BitLocker

• Turn on BitLocker option not visible: Verify that you are running Windows Pro, Education or Enterprise. Open gpedit.msc, navigate to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Removable Data Drives, and check the Turn on BitLocker To Go policy setting.
• Encryption interrupted: If power loss or system shutdown interrupts encryption, BitLocker will typically resume automatically when the drive is reconnected. If the drive becomes inaccessible, do not format it. Contact IT via Open a Ticket immediately.
• Write-protected drive: Ensure the physical write-protect switch on the USB drive (if present) is set to write-enable. Open Disk Management by right-clicking the Start button and selecting Disk Management, then verify the drive is not marked as read-only.
• Recovery key retrieval: For Azure AD-joined devices, the recovery key is backed up to Azure AD. Retrieve it via the My Devices portal. For personal Microsoft accounts, visit the Microsoft account devices page.
• Group Policy restrictions: Some organisations disable BitLocker for removable media. If you suspect a policy is blocking the feature, open a ticket with IT.

Method 2: Use FileVault for macOS

Create an encrypted disk image on macOS using Disk Utility

1. Insert the USB drive into your Mac.
2. Open Finder, go to Applications > Utilities, and double-click Disk Utility.
3. Select the USB drive from the sidebar, then click the Erase button in the toolbar.
4. Choose a name for the drive, select APFS (Encrypted) or Mac OS Extended (Journaled, Encrypted) from the Format menu, and choose GUID Partition Map for the Scheme.
5. Click Erase and enter a strong password when prompted. Verify the password and click Choose.
6. Wait for the process to complete, then click Done.

Accessing the encrypted drive on macOS

1. Insert the encrypted USB drive into your Mac.
2. Enter the password when macOS prompts you to unlock the disk.
3. Select Remember this password in my keychain if you want macOS to store the password for future use on this device.
4. Click Unlock to mount the drive and access your files.

Method 3: Use Linux encryption tools

Encrypt a USB drive using GNOME Disks on Linux

1. Insert the USB drive into your Linux computer.
2. Open the application menu and launch Disks.
3. Select the USB drive from the left panel.
4. Click the menu button (three dots) in the top-right corner and select Format Disk.
5. Choose GPT as the partitioning type and click Format.
6. Click the + button to create a new partition, then select Encrypted, underlying technology: LUKS as the type.
7. Enter a strong password and confirm it, then click Create.
8. Wait for the encryption process to finish, then click the Play (mount) button and enter the password to access the drive.

Method 4: Use company-approved encryption software

1. Open the Company Portal (Software Center).
2. Search for approved tools such as “ESET Endpoint Encryption” or “McAfee Complete Data Protection”.
3. Select the tool and click Install.
4. If no approved tool is listed, request software via Open a Ticket.
5. Launch the installed application and follow the vendor-specific steps to encrypt the USB drive.

Method 5: Use 7-Zip for file-level encryption

1. Download and install 7-Zip from the official website.
2. Right-click the files or folders on the USB drive, choose 7-Zip, then select Add to archive.
3. Set “Archive format” to “zip”.
4. Enter a password of at least 12 characters in the Encryption section.
5. Check Encrypt file names for additional security.
6. Click OK to create the encrypted archive.
7. To access the files, right-click the archive, choose 7-Zip > Extract files, and provide the password when prompted.

Changing or removing encryption

Change BitLocker password on Windows

1. Insert the encrypted USB drive and unlock it with your current password.
2. Right-click the drive in File Explorer and select Show more options > Manage BitLocker.
3. Click Change password to unlock the drive.
4. Enter your current password, then enter and confirm your new password.
5. Click Change password to save the update.

Remove BitLocker encryption from a USB drive

1. Insert the encrypted USB drive and unlock it.
2. Right-click the drive in File Explorer and select Show more options > Manage BitLocker.
3. Click Turn off BitLocker next to the USB drive.
4. Click Turn off BitLocker again to confirm decryption.
5. Wait for the decryption process to complete. Do not remove the drive or shut down the computer during decryption.

Remove encryption from macOS Disk Utility

1. Open Disk Utility from Applications > Utilities.
2. Select the encrypted USB drive from the sidebar.
3. Click the Erase button.
4. Choose a non-encrypted format such as MS-DOS (FAT) or ExFAT, then click Erase.
5. This will wipe all data on the drive and remove encryption.

Best practices for USB encryption

• Use strong passwords (12+ characters, mixed case, numbers, symbols) in line with the company password policy.
• Never store the password on the same USB drive.
• Keep the recovery key in a secure location separate from the device (Azure AD, Microsoft account, or a physical safe).
• Only use USB drives approved by IT for sensitive data.
• When travelling, keep encrypted USBs with you – not in checked luggage.
• Consider formatting to NTFS only if you need compatibility with very old Windows versions; otherwise, FAT32 or exFAT are acceptable for BitLocker.

For broader guidance on Windows security features, see How to protect your PC with built-in Windows security features.

Need more help?

If you need a company-approved encryption tool, are unsure which method to use, or require assistance with the encryption process, please Open a Ticket.

Still Having Issues?