Data read from a volume is decrypted using a first key. The decrypted data is encrypted using a second key. The encrypted data is written back to the volume. An access request to a location of the volume is received from a host. Data is encrypted to or decrypted from the location using the first or second key, in response to the access request. The first key is used for the access request if the location has not been decrypted using the first key and encrypted using the second key. The second key is used for the access request if the location has been decrypted using the first key and encrypted using the second key.