EFS Features in Visual C#

Paint Denso QR Bar Code in Visual C# EFS Features

Transparent encryption In EFS, file encryption does not require the file owner to decrypt and re-encrypt the file on each use. Decryption and encryption happen transparently on file reads and writes to disk. Strong protection of encryption keys Public key encryption resists all but the most sophisticated methods of attack. Therefore, in EFS, the file encryption keys are encrypted by using a public key from the user s certificate. (Note that Windows XP Professional and Windows 2000 use X.509 v3 certificates.) The list of encrypted file encryption keys is stored with the encrypted file and is unique to it. To decrypt the file encryption keys, the file owner supplies a private key, which only he or she has. If the owner s private key is unavailable, the recovery agent can open the file using his or her own private key. There can be more than one recovery agent, each with a different public key, but at least one public recovery key must be present on the system to encrypt a file. Many applications create temporary files while you edit a document, and these temporary files can be left unencrypted on the disk. On computers running Windows XP Professional, EFS can be implemented at the folder level, so any temporary copies of an encrypted file are also encrypted, provided that all files are on NTFS volumes. EFS resides in the Windows operating system kernel and uses the nonpaged pool to store file encryption keys, ensuring that they are never copied to the paging file.

Even when you encrypt files, an intruder who accesses your computer can access those files if your user account is still logged on to the computer. Be sure to lock your console when you are not using the computer, or configure a screensaver to require a password when the computer is activated. If the computer is configured to go to standby mode when it is idle, you should require a password to bring the computer out of standby. These precautions are particularly important on portable computers, which people are more likely to leave unattended while the user is logged on.

Increasing Security by Using EFS 10-51

The recommended method to encrypt files is to create an encrypted folder and place files in that folder. To encrypt a folder, use these steps: 1. In Windows Explorer, right-click the folder and click Properties. 2. In the Properties dialog box for the folder, on the General tab, click Advanced. 3. In the Advanced Attributes dialog box (refer to Figure 10-14), select the Encrypt Contents To Secure Data check box, and then click OK. 4. Click OK to close the Properties dialog box for the folder. The folder is now marked for encryption, and all files placed in the folder are encrypted. Folders that are marked for encryption are not actually encrypted; only the files within the folder are encrypted.

Exam Tip Compressed files cannot be encrypted, and encrypted files cannot be compressed with NTFS compression.

After you encrypt the folder, when you save a file in that folder, the file is encrypted using file encryption keys, which are fast symmetric keys designed for bulk encryption. The file is encrypted in blocks, with a different file encryption key for each block. All the file encryption keys are stored and encrypted in the Data Decryption field (DDF) and the Data Recovery field (DRF) in the file header.

If an administrator removes the password on a user account, the user account will lose all EFS-encrypted files, personal certificates, and stored passwords for Web sites or network resources. Each user should make a password reset disk to avoid this situation. To create a password floppy disk, open User Accounts and, under Related Tasks, click Prevent A Forgotten Password. The Forgotten Password Wizard steps you through creating the password reset disk.