User Tip #26: W2K Encrypting File System

Hits: Failed to execute CGI : Win32 Error Code = 3


Windows 2000 Pro includes an Encrypting File System ( EFS ) driver that renders volumes and files on NTFS volumes unreadable without the decryption key. You can encrypt at the folder or individual file level. It is best to use directory level encryption because anything created in the folder will be automatically encrypted, including temporary files generated by applications. If you have a laptop or a PC with sensitive data, EFS provides decent privacy protection. Remember that laptops are valuable, portable, and often stolen.

To use the Encrypting File System in W2K:

The Encrypting File System driver and the NTFS compression driver are mutually exclusive. You can use one or the other on a folder or file, but not both.

The cleanest method for recovering encrypted files in a domain environment is to use the Backup utility. This is a very safe method. It can be made more secure by requiring the DRA to authenicate via a smart card. The steps involved in performing a recovery:

In a domain there can be multiple recover agents. To decrypt the files successfully, you must have logged on with the recovery agent that was used during the encryption.

Another method to recover encrypted files is to export the DRA's private key and use it on a computer with encrypted data. This method is a bit faster than using Backup but it's not as secure because you have to import the private key to a destination machine.

Elcomsoft has created Advanced EFS Data Recovery to decrypt files encrypted on NTFS partitions in Windows 2000. Files can be decrypted even in a case when the system is not bootable and so you cannot log on, and/or some encryption keys have been tampered. Besides,they say decryption is possible even when Windows is protected using SYSKEY.