0

I only recently decided to implement EFS as a security measure, but during testing with an encrypted file, I found these shortcomings:

  1. You can copy an encrypted file to a USB drive, then transfer it to another computer, but the file is no longer encrypted. Okay, the USB was exFAT, so maybe that was the problem.
  2. You can put an encrypted file in a .zip file and transfer it via a USB flash drive to another computer; again, encryption is not retained.
  3. You can transfer an encrypted file via FTP but the file is no longer encrypted.

what's the point of the encryption if it is so volatile? I thought nobody else was supposed to read an encrypted file without the appropriate security certificate. This isn't happening for me. What am I doing wrong?

2 Answers 2

1

You have a misunderstanding of what EFS is for. Files are encrypted while they are at rest on the machine that encrypted them. Transferring files removes the encryption.

https://technet.microsoft.com/en-us/library/cc700811.aspx#XSLTsection123121120120

EFS isn't designed to protect data while it's transferred from one system to another.

4
  • that makes a lot more sense now, but what about when somebody gains access to your computer and copies your files over the network? or takes your computer, removes the hard drive and copies your files? if it does protect against that I would like to know how. and I thought it did. hearing about people whose computer went kaput so they transferred the hard drive to another computer for data recovery but they couldn't access the files because they didn't have the security certificate- when all they had to do was copy the files to their own folder and encryption would have been removed?
    – Fyodor
    Jun 11, 2018 at 4:58
  • It DOES protect against that. Encrypted files on EFS can only be read (and by extension, moved, copied, etc.) by apps running in the context of the user account that encrypted them. Other user accounts, regardless of their privilege level, cannot read the encrypted files ... at least, not without having received the cryptographic digital certificate.
    – user477799
    Jun 11, 2018 at 5:00
  • then how was I allowed to download an encrypted file via FTP? and when it got on the client computer it was unencrypted and I read the file. plz help me to understand, I just want to get my computer secured.
    – Fyodor
    Jun 11, 2018 at 5:05
  • 3
    You asked "What am I doing wrong?" Well, you are doing two wrong things: (1) When uploading the file to FTP, USB flash drive or another driver, you are actually asking Windows to decrypt it for you. (2) You are not realizing this youtself.
    – user477799
    Jun 11, 2018 at 5:08
0

The main purpose of EFS is to prevent other people from accessing files stored on your computer, while at the same time being completely transparent to yourself. (You can sort of think of it as a per-user alternative to full-disk-encryption such as BitLocker.) "Transparent to the owner" also means it's transparent to archiving or email apps – they have your certificate and can just read the plain contents without knowing that the underlying storage is encrypted.

It doesn't aim to prevent you from leaking your own data – it prevents other people from taking out your HDD and accessing the files.

That said, Windows 10 does have features that work more similarly to what you describe: in Pro, files copied to FAT can retain encryption; and in Enterprise, files tagged as 'Work' may get forcefully encrypted when copied to USB sticks to prevent leakage. I don't remember the exact feature name for the latter.

1
  • EFS protects files from other Windows users on the same machine. BitLocker protects all files on the HDD from anyone without the recovery key. They serve different purposes as this answer hints at.
    – Ramhound
    Jun 11, 2018 at 11:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .