Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

well i searched the site for software that encrypt folders on the harddisk and i found recommendation for TrueCrypt or similar products.
but the thing i wanted to know is that if i open a file on the encrypted Folder then will be the domain admin able to access my files on that encrypted folder using the default windows shares "\PCName\x$\" ? since the files are now unencrypted to any windows process. or i am wrong with my thoughts ?
the problem actually is that i want to keep private files on work machine with reserving my privacy and denying the admin from seeing my private files.

share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

If you do not trust a machine (and/or it's admin) then simply do not access anything you do not want to reveal - encrypted or otherwise.

Whatever method you use to encrypt/decrypt must make the file contents available to the machine (obviously, that's the point of decrypting it), and so also it's processes and the admin.

You might also be giving away the encryption key and password, so could reduce the security of everything you've got encrypted on that machine, not just the files that you open.

That said, you can store encrypted material in an untrusted location, as long as you do not decrypt it in an untrusted location.

share|improve this answer
    
so this is a valid concern? but is there a way that lets the current user only access the files but when the domain admin access the files it will be with domain/admin user so it will be a different user with no access to the saved password or this is not right? –  Karim Oct 3 '10 at 19:51
2  
@Karim - An evil admin could have a keylogger installed as far as you know. Then whatever you type is accessible to him, that includes your passwords. You simply can not be 100% sure to keep your files private on a computer you don't have 100% control over. –  Nifle Oct 3 '10 at 20:00
    
yeah but i am not talking extreme cases like a key logger, because having a keylogger maybe illegal in my opinion.but getting files from the company pc is not as far as know.of course cracking encrypted files of an employee is not legal too in my opinion. –  Karim Oct 3 '10 at 20:07
2  
@Karim: "in my opinion" is not a very valid legal statement. –  Hello71 Oct 3 '10 at 22:21
    
@Hello71: that is because i am not a lawyer, anyway i was asking about the technical aspect and not the legal one, because in each country laws are different so we can discuss this topic forever and besides the law aspect of this problem dont belong here, maybe on legaloverflow.com or something :) –  Karim Oct 3 '10 at 22:37
add comment

Yes, if you connect a drive to a computer, the domain admin will be able to see your files. The domain admin is trusted with access to anything the computer currently has access to. If you don't trust the computer administrator, don't trust the computer.

However, I find it unlikely the system administrator will be waiting for you to connect a drive so he can make a copy of all your personal files. As long as you unmount a TrueCrypt volume when you're not using it, you're probably reasonably safe. Once it's unmounted, someone could only access it again if they had your volume's password (perhaps there is a keylogger on the computer).

Why are you worried about this? Assuming this is a computer and network owned by a business you work for, I think the two most common reasons would be:

  1. You do not trust your system administrator. This is a concern perhaps you want to address with management. Since the system administrator often can access nearly anything in the company, if you have reason to believe they are not trustworthy, management should know about it.

  2. You are doing something clandestinely and are afraid of getting caught. You should be! If your workplace does not want you using their time and their resources for some activity, don't do it.

The only way to ensure the system administrator cannot access your files is to access them from a computer outside of his/her control. Perhaps bring a laptop with you and access the files from that machine.

share|improve this answer
    
well the admin dont have the autority to acccess my personal files, and i think any reasonable company policy will allow me to have such files on the work machine, for example i think its legal to see my bank statment from my work machine on my break time and save them to a place on the work machine , but the domain admin shoulndt see this information, i am not talking about work related information or something. –  Karim Oct 3 '10 at 19:54
    
In that case you must either trust the system administrator implicitly or not use a computer under his/her control. –  Stephen Jennings Oct 3 '10 at 19:58
1  
It will depend entirely on the country you are in. In the UK there are no laws that say a company is legally obliged to let you use their computers for personal business of any kind. Additionally most sysadmins won't have the time to go rooting through your workstations files. Unless you are being investigated for breach of company policy chances are they don't care and won't notice. (I know this is true for me, I have 600 desktops under my control and I certainly don't go around every machine browsing users files unless I've been asked to do so by HR) –  chunkyb2002 Oct 3 '10 at 20:01
    
i am not talking that there is a law that allows me or not to use the pc for personal business, if the company tells me i am not allowed its their decision, but what theya re not allowed to do is access my data on the their pc if they allowed to use this pc for personal business. –  Karim Oct 3 '10 at 20:05
1  
A company is well within their rights to monitor what their equipment is being used for (especially within their walls), even if they've authorized it for personal use. Not that I think you're doing any of these things, but they certainly don't want to deal with any lawsuits because their computers were used to commit fraud or distribute child porn. –  Stephen Jennings Oct 3 '10 at 20:16
show 8 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.