Full-disk encryption usually means encryption at the block layer below the filesystem. It doesn't actually have to cover the full disk.

There is almost always at least one unencrypted partition on machines with full-disk encryption, since the boot loader and then the decryption routine have to be launched from somewhere. And yes, OEM recovery partitions or similar laptop-specific needs are another case.

Full-partition would be a more accurate term than full-disk.

I use full-disk encryption on my old thinkpad. As in, the whole disk is encrypted, from first sector to last. There isn't even a MBR or a partition table on it! I boot the laptop from my USB stick which contains the kernel and initrd. That's what I call full-disk encryption ;)

Cool. :) Even there, you do have some disk or partition unencrypted, it just happens to be on removable media. Good counterexample, though uncommon.

Just make sure nobody swaps out your stick :)

I would love to see a post on how to set that up!

If you've ever installed gentoo, then it shouldn't be too difficult. Follow the installation steps but instead of partitioning the harddrive and installing into one partition, make the filesystem across the whole harddrive (eg. `mkfs.ext4 /dev/sda`) and install into that. The system on the laptop (Lenovo X61) is really old (like 8 years at least), back then I needed to perform some manual steps to ensure the initrd has the necessary tools so it can mount an decrypt the root partition, this is probably not necessary anymore. Upgrading kernels has to be done carefully, because I must make sure the USB stick contains a compatible kernel. I also need to configure the UEFI boot menu so that it knows where to find the kernels. Fun stuff.

I wouldn't know where to start if you want to use ubuntu or another more user friendly distribution though.

You _can_ do it with libreboot on ancient thinkpads, but it requires a decent time (or money) investment and some know-how. https://libreboot.org/docs/gnulinux/encrypted_trisquel.html

DiskCryptor does it in Windows fairly easily and lets you install the bootloader to USB.

Isn’t this how FileVault works?