An automated method for performing fault-recoverable full-drive encryption in a computer system having computing hardware including a data storage drive containing content to be encrypted, the method comprising: establishing, by the computer system, a plurality of segments in which the content to be encrypted is contained, each segment of the plurality of segments having a corresponding location on the data storage drive; allocating, by the computer system, a buffer in non-volatile storage; storing, by the computer system, a space mask in non-volatile storage that is configured to represent an encryption state of each segment of the plurality of segments; sequentially encrypting, by the computer system, each segment of the plurality of segments to produce a corresponding encrypted segment; in response to the encrypting of each segment, and prior to encrypting a subsequent segment, storing, by the computer system, a first copy of the encrypted segment in the buffer, and a second copy of the encrypted segment on the data storage drive; updating, by the computer system, the space mask to represent a current encryption state of the plurality of segments; in response to an interruption of the sequential encrypting of the plurality of data segments, identifying, by the computer system, a second segment, of which a first encrypted copy is stored in the buffer, but wherein the space mask indicates the second segment as not being encrypted, the second segment being subsequent to a first segment indicated as being encrypted in the space mask; in response to the identifying of the second segment, determining, by the computer system, based on the first encrypted copy of the second segment stored in the buffer, a current encryption state of the second segment; and in response to the determining of the current encryption state of the second segment, correcting the space mask, by the computer system, to indicate the current encryption state of the second segment. establishing, by the computer system, a plurality of segments in which the content to be encrypted is contained, each segment of the plurality of segments having a corresponding location on the data storage drive; allocating, by the computer system, a buffer in non-volatile storage; storing, by the computer system, a space mask in non-volatile storage that is configured to represent an encryption state of each segment of the plurality of segments; sequentially encrypting, by the computer system, each segment of the plurality of segments to produce a corresponding encrypted segment; in response to the encrypting of each segment, and prior to encrypting a subsequent segment, storing, by the computer system, a first copy of the encrypted segment in the buffer, and a second copy of the encrypted segment on the data storage drive; updating, by the computer system, the space mask to represent a current encryption state of the plurality of segments; in response to an interruption of the sequential encrypting of the plurality of data segments, identifying, by the computer system, a second segment, of which a first encrypted copy is stored in the buffer, but wherein the space mask indicates the second segment as not being encrypted, the second segment being subsequent to a first segment indicated as being encrypted in the space mask; in response to the identifying of the second segment, determining, by the computer system, based on the first encrypted copy of the second segment stored in the buffer, a current encryption state of the second segment; and in response to the determining of the current encryption state of the second segment, correcting the space mask, by the computer system, to indicate the current encryption state of the second segment.