Or even small organizations, or individuals. Our phones storage is uniformly encrypted by default now and have been for several years. There's absolutely no reason that Windows installs and Linux distros should offer unencrypted storage as anything but a hidden option for experts.
That said: there's no particular reason to think this laptop wasn't encrypted.
Because it doesn’t matter to most people outside of a business setting. Forgetting your password and losing your backup key is a bigger risk especially some backup drive of pictures/videos.
I think best practices will emerge eventually, that strike a balance. Like having a password but writing it down and putting it in an offsite safe deposit box. Or maybe something based on shamir's secret sharing.
We need to see a lot of failures (both failing open and closed) and do postmortems before one strategy is recognized as winner, that's what I believe.
You can always store disk encryption password in iCloud or Microsoft account. Actually, macOS and Windows don't even allow you to enable disk encryption, without either storing the password in a cloud/filesystem, or printing it out.
Of course, this doesn't help you if the police or the government is after you, but that's irrelevant for 99,99+% of people.
Just an anecdote, but I installed Debian on my laptop two years and I was impressed with how easy full-disk encryption with LUKS was to setup. All it took was checking the box and creating a password. No issues so far! It definitely does seem like something that could be opt-out rather than opt-in.
> There's absolutely no reason that Windows installs and Linux distros should offer unencrypted storage as anything but a hidden option for experts.
People unfortunately have been coddled by consumerism, or are coddled by job titles like "director" and "officer", and expect to be able to get passwords reset and access recovered by someone if they forget.
The correct way to do disk encryption is to not store the password anywhere, and define total loss of data as acceptable if the password is unknown. This puts vendors and subordinate-to-revenue-generation IT departments in a bad situation if a customer forgets their password and suddenly loses years' worth of family photos, small-business tax documents, etc.
> Our phones storage is uniformly encrypted by default now and have been for several years.
Only because phone storage is basically unimportant - most people sync everything (either of their own volition or via OS provider or via apps) from their phone to multiple cloud services and then the benefits of encryption-at-rest are honestly only their to protect and enforce the local app store and payment apps.
> subordinate-to-revenue-generation IT departments
If your company is large enough to have an IT Department, even if it's just one person with a sufficient amount of clue, they should know how to set up FDE with a recovery key manually stored in a secure location (even printed on a piece of paper locked in a safe of the CEO, or something).
I did this for my moms work when I was a teen. I didn't really know what I was doing but I figured it out. Backup keys in the fire safe. It all went smoothly.
Then a month later HQ relented because too many branches couldn't figure it out. These were financial advisors offices, in the days when client data was stored locally. Brokers being too lazy to enter the passphrase trumped information security I guess.
I don't really know how the "enterprise" solutions work, but I imagine they get the disk decryption key from AD or something, and thus the IT support team can "reset" disk encryption.
There are a variety of threat models, and whether or not this is acceptable depends on the worry that you have. If you are concerned that the IT department is going to decrypt executives' laptops and leak confidential information, then this isn't a good model. But if you're merely concerned that someone leaves their laptop in an airport, it's fine -- whoever picks that laptop up and resells it won't hack your directory system and be able to decrypt it.
A long memorized passphrase that only one person knows is the best possible way to prevent unauthorized access, but that isn't necessarily the problem that you're trying to solve with disk encryption.
> I don't really know how the "enterprise" solutions work, but I imagine they get the disk decryption key from AD or something, and thus the IT support team can "reset" disk encryption.
They don't get it from AD so much as Group Policy can be configured to have the device store the key in AD, but otherwise yes that's how it works.
>People ... expect to be able to get passwords reset
I think it works like that with Apple. When I turned on encryption it says do you want the key stored in the icloud thing and presumably in a locked out situation I get on to Apple to get it. Seems quite a good solution.
That said: there's no particular reason to think this laptop wasn't encrypted.