How It Works

• You turn on encryption with the “Encrypt” switch in the second step of creating a disk. On Windows, any file system works; on a Mac, an encrypted disk always uses APFS.
• The key is generated when the disk is created and lives only in memory while the disk is mounted. There is no password to enter: a RAM disk disappears when it is ejected anyway. On Windows, the driver's key is cut out of crash dumps, but a complete or active memory dump can still hold the service's copy of it. The exception is a startup disk that keeps its files: its key is needed to bring back the encrypted copy and is stored protected, on Windows with DPAPI of the SYSTEM account, on a Mac in the keychain.
• While an encrypted disk is mounted, anyone who has access to it can use it. The “Only me” access setting locks it away from other users of this computer. On Linux, disks are not encrypted, and their automatic copies in /var/lib/eramdisk are readable only by root. A file you save a disk to by hand can be encrypted with a password.