How are files encrypted in the EFS file system?

In the EFS (Encrypting File System) file system, files are encrypted using a public key encryption algorithm. Here are the general steps: A user selects the file or folder they want to encrypt. EFS generates a random symmetric encryption key to encrypt the file data. EFS retrieves the user's public key from the certificate stored in the user's profile. EFS uses the user's public key to encrypt the symmetric encryption key. EFS stores the encrypted file data and the encrypted symmetric key in the file's metadata. The encrypted file data and the encrypted symmetric key are stored on the disk. When the user wants to access the file, EFS retrieves the encrypted symmetric key from the file's metadata. The user's private key is used to decrypt the symmetric encryption key. The decrypted symmetric encryption key is used to decrypt the file data. The decrypted file data is loaded into memory and the user can access the file. It is important to note that EFS encryption only provides protection against unauthorized access to the file. It does not provide protection against unauthorized modification or deletion of the file.

How to decrypt files encrypted with EFS?

To decrypt files encrypted with EFS, follow these steps: Log in to Windows with the same user account used to encrypt the files. Right-click on the encrypted file or folder, and select ''Properties.'' In the ''Properties'' window, click on the ''Advanced'' button. In the ''Advanced Attributes'' window, uncheck the ''Encrypt contents to secure data'' option. Click ''OK'' to save the changes. If prompted, select the option to apply the changes to the file or folder, and its contents. The file or folder will be decrypted and can now be accessed without the need for the EFS key. It is important to note that if the EFS key was lost or damaged, or if the user account used to encrypt the file was deleted or its profile was damaged, it may not be possible to decrypt the file using this method. In such cases, data recovery tools or specialized data recovery services may be required.

What encryption algorithms are used in EFS?

EFS (Encrypting File System) uses several encryption algorithms, including the Advanced Encryption Standard (AES), Triple Data Encryption Standard (3DES), and Data Encryption Standard (DES). AES is the default encryption algorithm used by EFS in Windows 10, Windows 8, and Windows 7. In earlier versions of Windows, 3DES and DES are used as the default encryption algorithms. EFS also supports other encryption algorithms, including the Rivest-Shamir-Adleman (RSA) algorithm, which is used for encrypting the symmetric encryption keys.

Who can open a file encrypted with EFS?

A file encrypted with EFS can be opened by the user who encrypted the file and by any other user who has been granted access by the original user or an administrator. Access is granted through the use of access control lists (ACLs) that specify which users or groups are allowed to access the file and what level of access they have. It is important to note that if the user's EFS certificate or private key is lost or damaged, it may not be possible to access the encrypted file, even if the user has been granted access through ACLs.

To disable EFS, follow these steps: Open the Local Group Policy Editor by typing ''gpedit.msc'' in the Start menu search box and pressing Enter. Navigate to ''Computer Configuration'' > ''Windows Settings'' > ''Security Settings'' > ''Public Key Policies''. Right-click ''Encrypting File System'' and select ''Properties''. Select ''Do not use Encrypting File System'' and click ''OK''. Restart your computer to apply the changes. It is important to note that disabling EFS will make all previously encrypted files inaccessible. It is recommended to backup all encrypted files and decrypt them before disabling EFS.

Protect Your Files: How to Encrypt Files and Folders with EFS in Windows

Author: Vladimir Artiukh
Editor: Oleg Afonin
Updated: 19.11.2024 14:48

Looking to enhance the security of your files and folders on Windows 10, 8 or 7? Discover how to encrypt them using EFS with this step-by-step guide. Keep your data safe and secure from unauthorized access today!

Protect Your Files: How to Encrypt Files and Folders with EFS in Windows

Contents

Encryption keys are connected to a Windows user account, so other users of the same PC won’t be able to access the encrypted data. EFS encryption does not provide comprehensive protection as in case with Bitlocker. First of all, the system stores the encryption keys locally so intruders can get access to them. There is also a chance of secret data being stored in system temporary or auxiliary files which are not encrypted.

Nevertheless, EFS is a quick and easy way to protect separate files and folders on a computer where several users may work. Encryption with EFS will not take long, so let’s have a look how it works.

Characteristic	Description
Encryption Type	AES (Advanced Encryption Standard), 128 or 256 bits
Location of Encrypted Files	Individual files or folders on disks supporting NTFS are encrypted
Use	Encrypts data to protect it from unauthorized access, including individual files or folders
OS Integration	Integrated into Windows, available to users with administrative rights or appropriate permissions
Unlocking Access	Access to encrypted files requires the corresponding certificate or encryption key
Backup Support	Encrypted files can be saved and restored if the encryption key is available
Access Levels	Ability to set file access rights to allow access only to specific users
Access Recovery	Access can be recovered through a recovery key if the certificate or password is lost
Cross-platform Compatibility	Not supported on other operating systems, only on Windows
Multiple User Support	Encrypted files can only be accessed by users who have been granted appropriate access

Go to view

How to Set a Password to File or Folder in Windows 10, 8 or 7 🔐📂💻

Step 1. How to start encrypting data

EFS is not available for Home versions of Windows 10, 8 or 7, so if you have one, that is unfortunate. There is no point in encrypting data if you don’t use a reliable password with your user account – access to encrypted data is granted automatically when the user who has encrypted the data logs into the system.

After the files are encrypted, the system will automatically create a backup key to let you have access to data if you have problems with logging into the system, and you can’t sign in your account. For this purpose, any removable media will do, and a USB drive will be the best choice.

Go to view

How to Encrypt a USB Disk with BitLocker, Unlocking with Password or Recovery Key 🔐💻⚕️

Step 2. How to enable EFS in Windows 10

Select files or folders to encrypt with EFS and then do the following:

Start Windows Explorer in the Start menu, in the desktop or in the taskbar.
Right-click on the file or folder and select “Properties” in the menu.
In the tab “General” click on Advanced.
Check the box next to Encrypt contents to secure data.
Click OK, then Apply. You will see a dialogue box asking if you want to encrypt a selected folder only, or this folder and all of the folders and files inside it.
Click “Apply changes to this folder only” or “Apply changes to this folder, subfolders and files”.
Click OK.

The files encrypted with EFS will have a small lock-shaped symbol in the upper right corner of their icons. After encryption, no one is going to have access to such files until they sign in with your account.

Step 3. How to create a backup copy of the EFS encryption key

Go to view

Restoring a Deleted Folder from Recycle Bin, Archive or with Specialized Software 📁⚕️👨‍💻

After EFS is enabled, a small icon will appear in the taskbar. This is an EFS key backup notice.

Connect a USB drive to the computer.
Click on the EFS icon in the taskbar.
Click Backup now (recommended).
Click “Next”.
Click “Next”.
Check the box next to the password, then enter and confirm the password. Click “Next” to continue.
Click “Browse” and go to the USB drive to save the file.

That’s all. If you lose access to your Windows account, you’ll be able to use the backup key to access encrypted files in your computer. If you delete accidentally the files and folders encrypted with EFS, use our programs to recover encrypted NTFS files.