1
USING
"ENCRYPTING FILE
SYSTEM"
TO PROTECT
2
Web location for this
presentation:
http://aztcs.org
Click on
3
SUMMARY
Many of the "editions" of
"Windows 2000", "Windows
XP", "Windows Vista",
"Windows 7", and "Windows 8"
have the "Encrypting File
4
TOPICS
• Basics of Encrypting File System • "EFS" versus "BitLocker"
• "Encrypting File System" Service • Using the "Certificate Manager" to
Check for Existing Personal "Public Key Certificates"
• Encrypting A File or Folder with EFS • Using the "Certificate Manager" to
5
TOPICS (continued)
• .PFX "Personal Information Exchange" files
• Decrypting an EFS-encrypted file/folder • Deleted Certificates Stay in RAM And
6
BASICS OF EFS
• The "Encrypting File System"
(EFS) is a feature of "NTFS"
hard drives (and partitions)
for many editions of
7
BASICS OF EFS (continued)
• When view in "Windows
Explorer" ("File Explorer"), a
folder that contains only
"Encrypting File
9
BASICS OF EFS (continued)
• When viewed in "Windows
Explorer" ("File Explorer"),
a file that is encrypted by
"Encrypting File System"
will have it's name in
11
BASICS OF EFS (continued)
• Another user on the same computer will be unable to open/view the EFS-protected file.
• If someone takes your hard drive,
and puts it into an external hard drive enclosure and attaches the
enclosure to their own computer,
14
BASICS OF EFS (continued)
• "ESF" is a feature of "NTFS"
hard drives (and partitions)
for many editions of
15
BASICS OF EFS (continued)
• In EFS, "public key
certificates", "private keys",
and passwords to controll the
various keys all work together
to give you "two factor
16
BASICS OF EFS (continued)
• The advantages of having
certificates are detailed in `
17
BASICS OF EFS (continued)
• According to
http://en.wikipedia.org/wiki/Encr
ypting_File_System, Ecrypting
File System (EFS) is available
for the following editions of
18
19
BASICS OF EFS (continued)
• "Windows Vista Starter", "..Home
Basic", and "..Home Premium"
allow only decryption--so you can
read encrypted files but you
20
BASICS OF EFS (continued)
• For "Windows Vista Starter",
"..Home Basic", and "..Home
Premium" you can decrypt
EFS-encrypted files using the cipher
command line command. See
http://windows.microsoft.com/is-
21
BASICS OF EFS (continued)
• "Windows 7 Starter", "..Home
Basic", and "..Home Premium"
allow only decryption--so you can
read encrypted files but you not
22
BASICS OF EFS (continued)
• For "Windows 7 Starter", "..Home
Basic", and "..Home Premium"
23
BASICS OF EFS (continued)
24
25
BASICS OF EFS (continued)
• "Encrypting File System" is also
available for NTFS drives/partitions for the "..Pro" and "..Enterprise"
editions of "Windows 8".
• "Encrypting File System" will not be available for the "..RT" or "Windows 8" editions of "Windows 8".
• Reference:
26
"EFS" VERSUS "BITLOCKER"
• "Bitlocker" is used to encrypt entire hard drives or hard drive partitions whiile "Encrypting File System" is used to encrypt individual data files and/or folders
• "EFS" causes less of a
27
"EFS" VERSUS "BITLOCKER" (continued) • See
28
"ENCRYPTING FILE SYSTEM" SERVICE MUST BE SET TO "MANUAL" OR "AUTOMATIC"
• In order to encrypt or decrypt a
file or folder, the "Encrypting
File System" services has to be
set to "Manual" or "Automatic":
You can run services.msc from
29
"ENCRYPTING FILE SYSTEM" SERVICE SET TO "MANUAL" OR "AUTOMATIC" (continued)
• Step 1: Click on the "Start"
button in versions of "Windows"
prior to "..8" or, for "Windows
8..", hover over the lower-left
"Hot Corner" and use the
RIGHT mouse" to click on "Run"
in the pop-up "Power User
30
"ENCRYPTING FILE SYSTEM" SERVICE SET TO "MANUAL" OR "AUTOMATIC" (continued)
• Step 2: Type in
services.msc
32
"ENCRYPTING FILE SYSTEM" SERVICE SET TO "MANUAL" OR "AUTOMATIC" (continued)
34
"ENCRYPTING FILE SYSTEM" SERVICE SET TO "MANUAL" OR "AUTOMATIC" (continued)
• Step 5: Use the vertical scroll bar
on the right to scroll downward until you locate the "Encrypting File
System" service.
• Step 6: Use your RIGHT mouse button to click on it.
35
"ENCRYPTING FILE SYSTEM" SERVICE SET TO "MANUAL" OR "AUTOMATIC" (continued)
37
"ENCRYPTING FILE SYSTEM" SERVICE SET TO "MANUAL" OR "AUTOMATIC" (continued)
• Step 9: A "Properties" dialog box will be displayed.
• Step 10: Make sure that "Startup type" is set to "Manual" or
"Automatic". "Manual" is preferable. • Step 11: Click on the "Apply" button
38
"ENCRYPTING FILE SYSTEM" SERVICE SET TO "MANUAL" OR "AUTOMATIC" (continued)
• Step 12: Close the "Properties" dialog box.
• Step 13: Close the "Services"
40
USING THE "CERTIFICATE MANAGER" TO CHECK FOR EXISTING PERSONAL
"PUBLIC KEY CERTIFICATES"
• Step 1: Click on the "Start" button in versions of "Windows" prior to "..8" or, for "Windows 8..", hover over the lower-left "Hot Corner" and use the RIGHT mouse" to click on "Run" in the pop-up "Power User Context
42
USING THE "CERTIFICATE MANAGER" TO CHECK FOR EXISTING PERSONAL "PUBLIC KEY CERTIFICATES" (continued)
• Step 2: Use the right mouse button to click on "cmd.exe" in versions of "Windows" prior to "..8" or, for
"Windows 8..", use the left mouse button to click on "Command
44
USING THE "CERTIFICATE MANAGER" TO CHECK FOR EXISTING PERSONAL "PUBLIC KEY CERTIFICATES" (continued)
• Step 3: Use the left mouse button to click on "Run as administrator" in
versions of "Windows" prior to "..8" or, for "Windows 8..", use the left
mouse button to click on the "Yes"
46
USING THE "CERTIFICATE MANAGER" TO CHECK FOR EXISTING PERSONAL "PUBLIC KEY CERTIFICATES" (continued)
48
USING THE "CERTIFICATE MANAGER" TO CHECK FOR EXISTING PERSONAL "PUBLIC KEY CERTIFICATES" (continued)
• Step 5: Inside the command prompt window, type in certmgr.msc
50
USING THE "CERTIFICATE MANAGER" TO CHECK FOR EXISTING PERSONAL "PUBLIC KEY CERTIFICATES" (continued)
• Step 7: A "certmgr" Microsoft
52
USING THE "CERTIFICATE MANAGER" TO CHECK FOR EXISTING PERSONAL "PUBLIC KEY CERTIFICATES" (continued)
• Step 8: Double-click on the
55
USING THE "CERTIFICATE MANAGER" TO CHECK FOR EXISTING PERSONAL "PUBLIC KEY CERTIFICATES" (continued)
• Step 9: Double-click on
57
USING THE "CERTIFICATE MANAGER" TO CHECK FOR EXISTING PERSONAL "PUBLIC KEY CERTIFICATES" (continued)
• Step 10: Note that you presently
59
ENCRYPTING A FILE OR FOLDER WITH "ENCRYPTING FILE SYSTEM"
• Step 1: Start "Windows
Explorer" ("File Explorer").
61
ENCRYPTING A FILE OR FOLDER WITH "ENCRYPTING FILE SYSTEM" (continued)
• Step 3: Use the RIGHT mouse
to click on it.
• Step 4: A pop-up context menu
will be displayed.
63
ENCRYPTING A FILE OR FOLDER WITH "ENCRYPTING FILE SYSTEM" (continued)
• Step 6: A "..Properties" dialog
box will be displayed.
65
ENCRYPTING A FILE OR FOLDER WITH "ENCRYPTING FILE SYSTEM" (continued)
• Step 8: An "Advanced
67
ENCRYPTING A FILE OR FOLDER WITH "ENCRYPTING FILE SYSTEM" (continued)
• Step 9: Put in a checkmark for
"Encrypt contents to secure
data".
• Step 10: Click on the "OK"
button:
• Step 11: The "Advanced
69
ENCRYPTING A FILE OR FOLDER WITH "ENCRYPTING FILE SYSTEM" (continued)
• Step 12: Click on the "Apply"
button of the "..Properties"
71
ENCRYPTING A FILE OR FOLDER WITH "ENCRYPTING FILE SYSTEM" (continued)
73
ENCRYPTING A FILE OR FOLDER WITH "ENCRYPTING FILE SYSTEM" (continued)
• Step 14: Click on the "Continue"
button of the "Access Denied"
75
ENCRYPTING A FILE OR FOLDER WITH "ENCRYPTING FILE SYSTEM" (continued)
• Step 15: The "Access Denied"
box will disappear.
• Step 16: The file name(s) of the
newly-encrypted file(s) will now
be displayed in a
green font
to
indicate that the file(s) is/are
77
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED
"PUBLIC KEY" AND "PRIVATE KEY"
• Step 1: Click on the "Start" button in versions of "Windows" prior to "..8" or, for "Windows 8..", hover over the lower-left "Hot Corner" and use the RIGHT mouse" to click on "Run" in the pop-up "Power User Context
79
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
• Step 2: Use the right mouse button to click on "cmd.exe" in versions of "Windows" prior to "..8" or, for
"Windows 8..", use the left mouse button to click on "Command
81
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
• Step 3: Use the left mouse button to click on "Run as administrator" in
versions of "Windows" prior to "..8" or, for "Windows 8..", use the left
mouse button to click on the "Yes"
83
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
85
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
• Step 5: Inside the command prompt window, type in certmgr.msc
87
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
• Step 7: A "certmgr" Microsoft
89
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
• Step 8: Double-click on the
91
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
• Step 9: Double-click on
93
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
• Step 10: Note that you now have a newly-created "Public Key
Certificate" in the "Certificates"
95
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
• Step 11: Note that you now have a newly-created "Public Key
Certificate" in the "Certificates"
97
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
• Step 12: Use the RIGHT mouse
99
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
101
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
103
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
• Step 15: A "Certificate Export Wizard" dialog box will be
displayed.
105
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
• Step 17: Select the "Yes, export the private key" option.
107
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
109
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
112
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
• Step 21: Type in a password and record it somewhere in a secure
114
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY"(continued)
• Step 22: Type in the same password again.
116
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
118
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
121
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
• Step 26: When you arrive at the desired location for the .PFX file, type in a name for the .PFX file.
123
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
125
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
128
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
130
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
132
USING THE "CERTIFICATE MANAGER" TO EXPORT A NEWLY-CREATED "PUBLIC KEY"
AND "PRIVATE KEY" (continued)
135
• .PFX file(s) = "Personal Information Exchange" files
• .PFX file(s) an be moved, copied, renamed, and e-mailed without
restrictions.
136
• Double-click on it to "Import"
the certificate and the private
key into any computer or
Windows user account. Then
you can open/view the
associated the EFS-encrypted
data file
137
If your Windows user account or your Windows computer cannot open an EFS-encrypted file, do the following: • Step 1: Obtain the .PFX file (from
the creator/owner of the
EFS-encrypted file) and double-click on the .PFX file:
DECRYPTING AN
140
• Step 2: Click on the "Next" button of the "Certificate Import Wizard":
142
• Step 3: Click on the "Next" button: DECRYPTING AN EFS-ENCRYPTED
145
• Step 4: Type in the password for the .PFX file (which you should have
obtained from the creator/owner of the EFS-encrypted data file):
147
• Step 5: Select the "Mark this key as exportable" option.
• Step 6: Click on the "Next" button: DECRYPTING AN EFS-ENCRYPTED
149
• Step 7: Click on the "Next" button: DECRYPTING AN EFS-ENCRYPTED
151
• Step 8: Click on the "Finish" button: DECRYPTING AN EFS-ENCRYPTED
153
• Step 9: Click on the "OK" button: DECRYPTING AN EFS-ENCRYPTED
155
• Step 10: If you EFS-encrypted files are inside an EFS-encrypted folder, double-click on the folder to open it: DECRYPTING AN EFS-ENCRYPTED
157
• Step 11: Double-click on the EFS-encrypted data file to open it:
159
• Step 12: The EFS-encrypted data file will open with its default
associated software application program ("app"):
161
DELETED CERTIFICATES STAY IN RAM UNTIL YOU RE-BOOT
• If you run certmgr.msc to delete
a certificate from your
computer's hard drive, the
certificate will stay active in
162
OPTIONS IN "ACRONIS TRUE IMAGE.." FOR BACKING UP HARD DRIVES THAT
CONTAIN EFS-ENCRYPTED FILES
