Need to bounce some encryption thoughts off some fellow Linux nerds and get some advice.

Flagged as discussion because I'm hoping to have one haha. Admittedly, I might be a little bit more of a noob than a nerd... Anyways...

So I have a Thinkpad x9 that I bought with windows. I need dual boot. I installed Ubuntu 25.04 on it last year, and have since upgraded it through 25.10, and I'm now on 26.04.

Because I dual booted it, apparently, nothing was encrypted. I remember going back through the installer UI and picking luks, but I guess going back through the manual partitioning method on the version I used meant that nothing actually got encrypted.

So now I have a dual booted machine with no encryption whatsoever. Seems like newer Ubuntu versions do support using luks and dual boot.

So, what to do? It sounds like you cannot encrypt a partition while it is mounted, meaning that if I want to encrypt my Ubuntu partition, I would have to do a full clean install. That's a huge pain in the ass, but I do have a time shift back up that I could use to restore most stuff. And I guess it would be an exercise in making sure that that works like I think it does in case of future unplanned disaster.

However...

Full disc encryption (fde) really only protects you against threat models where your device is powered off. If it gets swiped from a coffee shop or confiscated by the cops (idk, maybe I have some spicy memes I'm taking through TSA that this admin doesn't like... kidding, but still) or something then the keys are still in ram, and a thief can just brute force your password to get past the UI.

I basically never turn off my laptop. I pretty much only reboot it when I have to for updates. I think this is very common behavior among people generally.

Android and iOS have changed their encryption methodology to use file-based encryption, where the device can boot the OS without the user putting in their password, and the user's data is protected with the screen lock. Clearly, since it can boot, the whole drive isn't uniquely encrypted, but if your phone gets stolen or something, your lock screen can still protect your data.

I was asking Gemini about Linux's approach to this, and it said the Linux approach has pretty much settled on full disk encryption instead of only encrypting your home directory, but that Ubuntu does still support encrypting just your home folder, and that it would be protected by the OS's lock screen.

So, here's my dilemma: why has Linux settled on fde instead of encrypting the home folder? It doesn't matter that much if certain OS files are recovered by an attacker, but it'd be pretty bad if your personal files were compromised. I'd really like to avoid having to reinstall my system if possible, and it seems like encrypting my home folder better matches my threat model of having my device swiped in public while powered on, but locked. On the other hand, this doesn't seem to be the recommended way to go, and I would also be worried about support for just encrypting /home being removed in the future.

What does