Sophia travels a lot and worries that her laptop containing confidential documents might be stolen. What is the best protection that will work for her?

Disk encryption - such as BitLocker on Windows or FileVault on macOS - encrypts the entire volume, meaning that even if the physical drive is removed and connected to another machine, all data remains ciphertext and is inaccessible without the decryption key or passphrase. This is the strongest protection for data at rest on a portable device, directly addressing the threat of physical theft of a laptop containing confidential documents.

A BIOS password only prevents booting from the device's OS; an attacker can remove the hard drive and mount it in another system, bypassing the BIOS entirely and reading all data.

Hidden folders rely on security through obscurity and provide no actual encryption; any attacker with basic OS tools or by booting a live OS can enumerate and access all folders.

Password-protected files only secure individually wrapped files and can often be bypassed with widely available cracking tools, leaving unprotected files fully exposed.