Why is an EFS-encrypted file decrypted when it gets uploaded to the Internet?

  • 3
    Because this is how the system is designed to work. It is a "transparent encryption" designed to protect files on your local drive. For more details read en.wikipedia.org/wiki/Encrypting_File_System – Robert Jan 4 at 14:26
  • Nothing special about EFS or uploading to internet. The same will happen if you copy a file on a bitlocker encypted drive to an unencrypted drive - the result will be an unencrypted file. – lx07 Jan 4 at 14:26
  • @lx07 sorry i haven't used bitlocker. Thanks for the insight. – Kurt Louis Jan 5 at 8:36

Because you uploaded the file.

As far as you (as a user) or any programs you run, the files are completely unencrypted.

EFS is designed to protect you against other users who have access to your system, not to protect you from yourself. It's intended use case is where you have a shared drive and a location where you want the data protected from other users, for the owner of the files the encryption is essentially transparent and the files are as good as unencrypted.

Any program you use to open the files, whether it is notepad, a media player or even your web browser will see an unencrypted file. As a result you uploading the file uploads the actual contents of the file, not the encrypted data.

From Wikipedia: Encrypting File System:

When an operating system is running on a system without file encryption, access to files normally goes through OS-controlled user authentication and access control lists. However, if an attacker gains physical access to the computer, this barrier can be easily circumvented. One way, for example, would be to remove the disk and put it in another computer with an OS installed that can read the filesystem; another, would be to simply reboot the computer from a boot CD containing an OS that is suitable for accessing the local filesystem.

The most widely accepted solution to this is to store the files encrypted on the physical media (disks, USB pen drives, tapes, CDs and so on).

In the Microsoft Windows family of operating systems EFS enables this measure, although on NTFS drives only, and does so using a combination of public key cryptography and symmetric key cryptography to make decrypting the files extremely difficult without the correct key.

So the files are protected against other users and attack via alternative operating systems, not protected against you.

EFS is not a method for securely transferring files across the internet. It is essentially an ultra lightweight and targetted file/disk encryption system. It provides some of the benefits of disk encryption without the ongoing permanent overheads.

If you want the files encrypted then you should use one of the many dedicated programs for the task.

  • "Because you uploaded the file." - What about it?. "not to protect you from yourself" - Not really necessary to say this. "As a result you uploading the file uploads the actual contents of the file..." - This is my question. I want to know why is this. "...not the encrypted data" - Isn't the encrypted data supposed to be my file? I encrypted the contents of my file so shouldn't be the "encrypted data"? "ongoing permanent overheads" - What are ongoing permanent overheads? – Kurt Louis Jan 5 at 8:34
  • @KurtLouis as mentioned in my answer it functions as a lightweight way to encrypt data on disk similar to full disk encryption. Full disk encryption (FDE) requires the system to encrypt/decrypt all data read or written, which is the permanent overhead, EFS simply does it on a file by file basis but still below a level that the user will notice any difference between "encrypted" and unencrypted data. You didn't encrypt the file at all, you told the OS that you wanted the data stored on disk to be encrypted. Would you expect a FDE system to upload encrypted data? – Mokubai Jan 5 at 8:45
  • @KurtLouis you need to get the idea that what is stored on disk are "files" out of your head. What is stored is nothing but blocks of data surrounded by metadata that tells the operating system how to retrieve the entirety of the file. Windows extends the metadata to allow the operating system filesystem driver to be able to secure the underlying data on disk without any change to the file as seen by the user. The hierarchy is File <-> Filesystem <-> Data <-> Disk. EFS operates on the data going to the disk, not the file itself. – Mokubai Jan 5 at 9:04
  • Okay, thanks a lot for that. Although, I think it's after this one more question that I have that I'll finally get everything. I'm just wondering why I wasn't able to see the contents of the file when I copied it from the first computer, where it was encrypted, and pasted it onto a flashdrive and inserted it to another computer and opened it there. I mean, what's the difference of that and uploading it? – Kurt Louis Jan 5 at 14:20
  • Copying via filesystem methods to an EFS supported filesystem will keep the file encrypted using a key held by your user account. Encryption status is part of the file properties which Windows maintains. The same would be true if you used EFS to encrypt data on that memory stick after copying it. The key in your account is not transferred with the file and so the file cannot be decrypted on another computer. It will still appear unencrypted to the original computer. I believe Windows 10 added support for EFS on exFAT and FAT32 disks. (It should be on the Wikipedia page I linked) – Mokubai Jan 5 at 14:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.