1

Example: Bitlocker: during encryption process, the pc got shutdown suddenly due to power failure, part of the data will be left unencrypted, which intruder can gain access to.

I'm thinking will bitlocker + efs solve this issue? Since efs will ensure the encrypted data can only be access by a particular user. So even if someone got holds are the hdd (which has a failed bitlocker encryption process example 20%). He/she wouldn't be able to access since he/she needs to login using username/password.

  • "during encryption process, the pc got shutdown suddenly due to power failure, part of the data will be left unencrypted" - that's the case only when you first time setup Bitlocker, later data will already be written encrypted so above mentioned scenario won't happen. So to solve that problem it's enough to keep your pc in a safe place while encryption is completed - or even better, activate bitlocker right before starting to use the pc. – Máté Juhász Oct 1 '18 at 12:57
0

First, once BitLocker completes it's encryption process there should be no unencrypted data left, so your example scenario should be very short lived.

But if you did want to use EFS together with BitLocker:

  • You would be adding another layer of security (which is good), perhaps at the expense of performance (perhaps bad).

  • BitLocker locks the entire drive for all users, while EFS only locks a few select files for one user, so you could for example use EFS to try keeping only some of your personal files away from another user that already has BitLocker access

    Note: If they're a root user / Administrator then apparently they could find out your password if they were determined: From Protect mounted Bitlocker drive from other users (by Ryan Ries, 49.5k rep "Windows Escalation Engineer at Microsoft")

    you wouldn't be able to use something like EFS, since EFS is dependent on your Windows or AD username and password, and any administrator on the same machine is easily capable of stealing your Windows or AD username and password by inspecting lsass process memory or installing a keylogger.

  • 1
    Your comment about an Administrator changing the password of a user, with regards to EFS is not correct, if a password was change by an Administrator they still could not access the files if EFS was being used. This is because the user's password is used to encrypt the files, so if an Administrator resets a password (which is the only thing they can do), the files would still be encrypted. This is the reason Windows warns you of that fact, when you reset a user's password, and if EFS is being used it means the loss of those files – Ramhound Oct 1 '18 at 13:35
  • To be clear, an Administrator within Windows, has no way to determine another user's password (in plain text). An Administrator can only reset a user's password. – Ramhound Oct 1 '18 at 13:38
  • @Ramhound There's a similar question (on another SE site) where the reasoning was that a Windows Administrator could read any user's unlocked EFS key directly from memory (somehow), or install a keylogger to capture the login passphrase, or do any other malicious things that can happen to a compromised computer. I assumed just changing one user's password would not grant EFS access (and technically I didn't say they could do that), it should be similar to eCryptfs in that way at least, but if you're not the only administrator on a computer then consider it a compromised insecure computer. – Xen2050 Oct 2 '18 at 5:19
  • Found the reference: Protect mounted Bitlocker drive from other users "you wouldn't be able to use something like EFS, since EFS is dependent on your Windows or AD username and password, and any administrator on the same machine is easily capable of stealing your Windows or AD username and password by inspecting lsass process memory or installing a keylogger." – Xen2050 Oct 2 '18 at 7:34
  • The Administrator would need to know the user's password in order to import the certificate. If the Administrator is using a keylogger, everything goes out the door, I stand by my comment. EFS can be used, and if used, an Administrator will not be able to access your files. – Ramhound Oct 2 '18 at 8:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.