Windows 7 - Encrypting File System

[Cheetah Designs]

I recently had to sell a computer and had to wipe the drives properly before I sold it to ensure that the data wasn't recoverable.

I want to prevent myself having to do this in future and it's my understanding that by encrypting the files I don't want readable, I can keep them safe.

I was looking into the simplest way to do this and noticed that Windows 7 Professional has an inbuilt encryption functionality. (I.e. I can right click on a folder and click encrypt). How fullproof is this encryption?

I understand that if I move something out of that folder or move the folder itself, it is no longer encrypted.

What if my laptop got stolen for instance, would the files be recoverable if they booted into linux to read the files? Is there anyway to hack into the files easily without knowing my windows password?

Essentially, what I am asking is: what are the vulnerabilities of doing this?

 

[Cheetah Designs]

I'm not talking about Bitlocker (not included in Windows 7 Professional anyways IIRC), I am talking about Encrypting File System.

Thanks for the reply.

 

[Cheetah Designs]

The crypto in EFS is solid, it uses top quality algorithms with no known vulnerabilities. The key point however is that it's only securing a subset of your disk. For example, you might have an encrypted file that you edit that leaves metadata scattered over the disk, maybe in the temp directory. So you can't guarantee it isn't leaked to unsecured areas of the disk. Also, when you encrypt a file, it isn't securely erased so forensic disk analysis may turn up the unencrypted originals which isn't great! This can be mitigated depending on how you manage the directory structure though.

If the laptop was stolen then any EFS protected files are safe to the extent of the strength of your Windows password. That is, the encryption keys that EFS uses are both derived from and unlocked by your Windows user password. Also, make sure you backup the EFS certificates!

The best solution as theheyes is going the whole way and securing the full disk with Truecrypt.

Wow, very interesting points you make!

Can you give some examples of what might leave a metadata trace? Also, why should I backup the EFS certificates? Surely if someone got hold of this backup they could access my files?

 

[Cheetah Designs]

Interesting. Thanks for the advice.

Surely the metadata trace thing would be true of all encryption systems that don't encrypt the whole filesystem....right?

 

[Cheetah Designs]

Pretty often the case yer, if you encrypt something outside of a secure system (e.g full disk) then you have to be very careful what traces could have been left behind of the unencrypted version. Usually it's safe as the encrypted version overwrites the original on disk which is fine. Problems occur when you start moving stuff around and have old copies, meta-data etc.

Are these the sort of traces that programs like CCleaner clear?

EDIT: I should say "attempt to clear".

 

[Cheetah Designs]

Its not that Im particuarly worried, just trying to get a balance between secure data and performance.

If I encrypt the whole drive it will drain battery life nad affect performance. Its just a few files that I want to encrypt (files that already exist and are held in an encrypted zip file). I only ever view them, not edit them.

It wouldnt be the end of the world if someone got the files, but I like to be able to run a pass of ccleaner, then do a freespace wipe and be able to sell the computer rather than wiping the whole drive.

Then I can simply wipe the drive with a quick format before I get rid.

 

[Cheetah Designs]

I was under the impression that it signficantly affected performance (as in halved read/write speeds) and obivously affects CPU usage (encrypting/decrypting) and therefore battery life.

Probably just my way of thinking!

 

[Cheetah Designs]

Right after a lot of research I feel Windows EFS is what I want. Thanks for the information to everyone that posted in this thread.

I do however have one more question. You suggested backing up the certificates, is this so I can still read the files if Windows gets corrupted? Like just install another Windows installation ontop with the same username and password and restore the certificates?

 

[Cheetah Designs]

Yes, or if you forget your password! Use of a safe is recommended here!

So you will ONLY need those certificates to recover the data...correct?

 

[Cheetah Designs]

Yes, but keep in mind that the need for recovery may well be higher with EFS that other systems.

For example, don't know if this is still the case (hopefully not!) but when you used to change your windows password you were screwed because the private key was encrypted with the Windows logon password and changing it fubared the system.

So edge on the side of caution and backup the certs safely

I believe this is still the case (according to the research I have done). But lets say I did change my password, so long as I had those backup security certficates, i can still access the files...right?

 

[Cheetah Designs]

Surely then its the certificate files that are the key to the encrypted files and not your windows password?

Would that be correct?

Or is it the case that the certificate files are encrypted USING your windows password? and when you export them for backup, you are exporting an UNENCRYPTED version.

 

[Cheetah Designs]

Correct.

Just follow something like this: http://www.pctipsbox.com/back-up-encrypting-file-system-efs-certificate/ the export wizard lets you protect (encrypt) the certs with a new password during backup. Just remember that so long as you are logged into the box the certs are decrypted, otherwise they are as you said protected by the windows password.

Great thanks for your help.

Surely if you are logged in using TrueCrypt you get the same "security risk"? Non?

I will just backup the certificates and archive them with 7z + passworded AES256 encryption.

 

[Cheetah Designs]

Thanks for the clearup...just as I thought.