|Windows Bootup Process
|Encrypting File System
|NTFS vs FAT File System
Windows XP, 2000 and Server 2003 have introduced a way to protect your information from unauthorized access. Fully integrated into the Windows Explorer shell, EFS or the Encrypting File System uses a combination of symmetrical and public/private key encryption to secure data that is stored in NTFS partitions.
Technically, it uses the DESX or Data Encryption Standard X algorithm to encrypt data. EFS helps to counter the vulnerability found in the NTFS ACL, whereby protected data can be accessed when the attacker gains physical possession of the computer with the exploitation of third party recovery software.
How Does EFS Works?The first time you perform an encryption, EFS will automatically generate a public key pair and file encryption certification.
A random generated key called the File Encryption Key (FEK) encrypts the data. This FEK is then encrypted with the EFS public key which is also stored along with the encrypted file.
The private key which resides within the user's profile is used to decrypt the FEK which in turn decrypts your data. Each time you open an encrypted file, EFS will search the system's key store for a file encryption key.
When an unauthorized personnel tries to open an encrypted file, an Access Denied error message will be displayed. Copying a regular file into an encrypted folder will render the file encrypted. Doing the reverse will still maintain its encryption status.
All the time, the encryption and decryption of data is done "on the fly" without even noticed by the user. If set up properly, even a system administrator will not be able to "peep" the data as the data access is no longer depending on conventional Windows file security attributes.
To encrypt or decrypt a folder, follow these steps:
- Right click on the folder to be encrypted and select Properties
- On the General tab of the Properties dialog box, click Advanced
- Select the option to Encrypt Contents To Secure Data and click OK
To decrypt, simply clear the Encrypt Contents To Secure Data checkbox.
- Click OK in the Encrypted Files Properties dialog box
When EFS encrypts a file, the following occurs:
- A symmetric key or File Encryption Key (FEK) is generated
- System uses the FEK and DESX algorithm to create the encrypted file
- FEK is encrypted using the user's public key
- Both keys are attached to the encrypted file in a special field called the data decryption field
Considerations: Windows Encrypting File System
Export and Saved Your Keys
To fully secure your encrypted data, you are advised to export your private key and certificates to a removable drive when the workstation is not in use. When you need to decrypt the file, restore the private key back into the workstation.
Encrypt Folders Instead
It is recommended to encrypt a folder rather than individual files. To decrypt all files under the folder, you just need to select a single folder.
Designate Recovery Agents
Windows allow you to set up a recovery agent accounts to provide means for data recovery in case you lose your primary key, without which your data may no longer be accessible.