> Choose a disk that supports Full Disk Encrpytion ... This way the encryption/decryption is done by the chip inside HDD and there is no OS security issue that

> Choose a disk that supports Full Disk Encrpytion ... This way the encryption/decryption is done by the chip inside HDD and there is no OS security issue that can compromise the data or performance hit on the main cpu. The parent is referring to Self Encrypting Drives (SED), AFAICT. I looked into them a little recently, but I'm not an expert. Consider the following only a starting point: Beware that not every SED tech is equally secure; some are easily bypassed. The industry standard, and the one I would depend on, is Opal. It usually requires tools in the OS to activate, but I would be surprised if those tools weren't available for major Linux distros. https://www.trustedcomputinggroup.org/storage-work-group-storage-security-subsystem-class-opal/ https://www.trustedcomputinggroup.org/storage-work-group-sto... Microsoft provides something called eDrive, which AFAICT (I looked at it briefly) integrates Windows Bitlocker with SEDs. > Lenovo has this SED tech is a feature of the hdd/ssd, not the computer vendor. The BIOS has to integrate with the SED but I think that is standard, at least in business-class computers (but double-check before you buy!).