Windows 7 Encrypting File System

BitLocker is not a replacement for the EFS introduced in Windows 2000, but it is a supplement to the EFS that ensures that the operating system itself is protected from attack. Best practices for protecting sensitive computers and data will combine the two features to provide a high level of assurance of the data integrity on the system.

EFS continues to be an important data-integrity tool in Windows 7. EFS allows the encryption of entire volumes or individual folders and files and can support multiple users using the same computer, each with protected data. Additionally, EFS allows multiple users to have secure access to sensitive data while protecting the data against unauthorized viewing or modification. EFS cannot be used to encrypt system files, however, and it should be combined with BitLocker to encrypt the system drive where sensitive data must be protected. EFS is susceptible to offline attack using the SYSKEY, but when you combine EFS with BitLocker to encrypt the system volume, this attack vector is protected.

EFS uses symmetric key encryption along with public key technology to protect files and folders. Each user of EFS is issued a digital certificate with a public and private key pair. EFS uses the keys to encrypt and decrypt the files transparently for the logged-on user. Authorized users work with encrypted files and folders just as they do with unencrypted files and folders. Unauthorized users receive an Access Denied message in response to any attempt to open, copy, move, or rename the encrypted file or folder.

Files are encrypted with a single symmetrical key, and then the symmetrical key is encrypted twice: once with the user's EFS public key to allow transparent decryption and once with the recovery agent's key to allow data recovery.

The sections that follow describe how to manage EFS keys. For general information about EFS, read "Encrypting File System in Windows XP and Windows Server 2003" at http://technet.microsoft.com/en-us/library/bb457065.aspx.