Sector map-based rapid data encryption policy compliance

A computing device comprising:

• one or more hardware processors;
• and
• one or more computer storage media devices having stored thereon multiple instructions that, when executed by the one or more processors to comply with a policy for the computing device, cause the one or more processors to:
• access a sector map identifying one or more sectors of a storage volume written to prior to changes to the sector map being locked to prohibit changes to the sector map, the sector map further identifying, for each of the one or more sectors, a signature of the content of the sector, the policy indicating that data written by the computing device to the storage volume after activation of the policy be encrypted;
• in response to a request to read the content of a sector of the storage volume:
• read the content of the sector from the storage volume and return the content of the sector of the storage volume without decrypting the content in response to both the sector not having been written to after the sector map was locked to prohibit changes to the sector map and the signature of the content of the sector matching the signature of the sector identified in the sector map;
• and
• read the content of the sector from the storage volume, decrypt the content of the sector of the storage volume, and return the decrypted content in response to the sector having been written to after the sector map was locked to prohibit changes to the sector map.

A method implemented in a computing device, the method comprising:

• accessing a sector map identifying one or more sectors of a storage volume written to prior to changes to the sector map being locked to prohibit changes to the sector map, the sector map further identifying, for each of the one or more sectors, a signature of the content of the sector, the computing device complying with a policy indicating that data written by the computing device to the storage volume after activation of the policy be encrypted;
• in response to a request to read the content of a sector of the storage volume:
• reading the content of the sector from the storage volume and returning the content of the sector of the storage volume without decrypting the content in response to both the sector not having been written to after the sector map was locked to prohibit changes to the sector map and the signature of the content of the sector matching the signature of the sector identified in the sector map;
• and
• reading the content of the sector from the storage volume, decrypting the content of the sector of the storage volume, and returning the decrypted content in response to the sector having been written to after the sector map was locked to prohibit changes to the sector map.