Advanced Data Protection in Windows

In my last article I gave an introduction to basic data protection methods available in Windows. The methods I outlined provide a moderate level of protection that, due to their inherent shortcomings, may not be enough. For those who require a higher level of security, Windows provides two more methods of protecting your data.

Both of the advanced methods I'll be describing utilize encryption. In layman's terms, encrypting a file scrambles its contents and rewrites it to the drive. It can only be unscrambled if the proper credentials are provided.

The effectiveness of file encryption is dependent upon the algorithm being used and the strength of the encryption key that is provided. However, without the necessary encryption key, a file is effectively unreadable. Since this method of protection does not rely on the operating system, it provides a much more secure form of data protection.

The method I'll be covering in this article is an NTFS feature known as Encrypted File System. This encryption method is built into the file system and is available to any operating system that supports NTFS. By default, this is Windows 2000 and newer.

In Windows 2000 and Windows XP, EFS is only available in the Professional editions. This is because the home versions use a different NTFS driver that lacks support for EFS. Newer versions of Windows support EFS in all versions.

Encrypted File System in Windows relies on your user information to create the encryption key. It creates a sort of password hash based on your account SID. This is important to remember, because if you change accounts you will no longer have access to your files. I'll describe how to back up your key later in this article in case something goes awry.

In Windows, EFS must be enabled on a file-by-file basis. (Encrypting a folder actually applies EFS to each of the child files.) In its original design, you were only able to encrypt files under your own user directory. Now, however, you can encrypt any file based on your account credentials.