Most of these FDE products virtualise the disk from the operating system, the operating system effectively thinks it's sitting in a VM, with the Encryption software acting as the "Host", if you get more disk activity created by the OS, then the amount of work the hosting encryption software is doing increases. Move this process into hardware and the OS is not affected, a chip takes over from the encryption / decryption and the OS thinks that the encrypted disk is just another normal disk.
The OS is not virtualized in any way. On a Windows system, the pre-boot authentication software will load the encryption key (which is encrypted with the user's password) and provide BIOS hard drive emulation. Then, control will be handed over to the Windows bootloader, which will load the kernel & drivers through the BIOS. One of these drivers will be the encryption driver - something sort of like a filter sitting between the filesystem drivers and the hardware drivers. All HD reads/writes will go through this driver before touching the drive; the OS itself is not virtualized in any way. The BIOS hard drive emulation is only used before Windows starts the kernel (which happens shortly after the Windows boot progress screen loads.)
In my experience, the impact on system performance is negligible once the initial encryption is performed, using PGP.
Actually, if a thief really wanted to unencrypt the drive, all he would have to do is use some good social engineering to get the master password. FV and Undercover work the best because you encrypt what you need to encrypt and have a very high chance of getting the laptop recovered. With FDE, you have a sense of security, but really cannot be sure.
These are problems of a bad implementation of full-disk encryption. A decent implementation will have no master password whatsoever. Without the end user's password, only system-specific recovery passwords can be generated. Unless your support staff would hand these out every time some random guy calls in and asks for one, this problem does would not exist.
The Admin(s) have to give each user access to unencrypt their own laptop. So at a minimum, two users are assigned to each laptop. In a large environment, there are multiple Admins managing FDE. So, if you social engineer the password.
Enterprise hard disk encryption software is smarter. In an enterprise environment with a registration server set up, PGP allows end users to self-register (no admin intervention necessary). Only one user is able to use the laptop. The encryption key is stored in encrypted form on the server. In event of an issue (if the OS won't boot or the user forgot his/her password), a recovery code can be generated by administrators by following a process that will create audit records.
PGP also does not give any user information at its login screen - there is only a password prompt. So, if a laptop was stolen, the thief would need to identify the user some other way to even figure out who to try to social engineer.
Although FV is slow, the chance of disk corruption is far less than FDE. I'm sure that the majority that have had to work with FDE in the real world are not big fans of it. At least not with Macs. For very sensitive data, you not only want want encryption, but you want the laptop back in you possession as soon as possible.
What exactly is the risk of disk corruption by using FDE?
