The key is encrypted with a KEK which is derived from a users password.

What many of these encrypted drives do is just always run the encryption but with either a default key which is all zeros or with an unencrypted key until the user enrolls into the encryption feature at which point the key will be encrypted with their password or fingerprint.

The way I do it is I format the drive on Linux. Then format it as ext4 with LUKS encryption. Were you on Windows?

Sometimes the default key is also all zeros/ones until the user has initialized the encryption function at which a random key is generated and encrypted with a KEK.

W/E you format the drive with or too or how you use it doesn’t matter, you don’t have raw access to drives anymore (sectors, clusters etc don’t mean anything anymore) with or without encryption the controller basically emulates an “ideal drive” to the OS and does it’s own thing.