Windows 10: File encryption fails?

Hallo friends,

I tried to encrypt a file located in my Dropbox account. I went to File->Properties->General->Advanced->Encrypt contents to secure data.

After I did what I did, the file had a golden locker icon attached on it. I opened my other laptop and after Dropbox updated the file to its new version, I tried to open it expecting to see nothing of use. Guess what. I could read my text file crystal clear.

So what happened here? Am I doing something wrong?

:)

 

New files not being encrypted

I had my Camera Uploads folder from Drobox set as compressed. I have changed this to encrypted for a bit more security.

The issue I'm having is that any new files created in the folder are set as compressed and not encrypted.

The parent folder(Dropbox) is set as encrypted, the folder itself(Camera Uploads) is set as encrypted and all previous files were encrypted. Only two files that are not encrypted are two hidden files(.dropbox.attr and desktop.ini).

I have enabled encryption using both through the Properties menu and using cipher.exe and new files are not being encrypted.

The documentation says I just need to encrypt the parent folder and all files moved to, copied to, and created in the folder will be encrypted, yet new files are created with the compressed attribute.

 

Cannot decrypt folder but files and sub-folders contained do decrypt

Hi Paola,

Thank you for your interest in this problem.

• Which encryption software did you use to encrypt the files?
  
  All of the encryption done was using EFS in Windows 10 Pro.
  
• How did you encrypt the files?
  
  The files were encrypted by selecting a folder in File Explorer then right clicking to choose Properties, pressing the Advanced button to the Advanced Attributes screen then checking the box: "Encrypt contents to secure data." Then pressing “OK”
  back to Properties, “OK” again to the Confirm Attribute Changes, select "Apply changes to this folder, subfolders and files," and OK once more. The encryption then proceeds and all subfolders and files are encrypted. The files were then decrypted by much
  the same process but rather unselecting the "Encrypt contents to secure data" box. This decrypted all the contained files, but the folder and all subfolders remained encrypted. After this the contained files could not again be encrypted by encrypting the
  folder because the "Encrypt contents to secure data" box for the folder was already checked.
  
• How are you able to verify that the files inside the encrypted folders were already decrypted?
  
  By selecting a file and again choosing Properties / Advanced to observe whether the box: "Encrypt contents to secure data" was or was not checked.
  

 

EFS encrypts files as they are stored on disk (so if someone steals your disk they can't read them without knowing your password). The encryption is automatically removed if you move or copy the file to a non-encrypted folder or drive and according to The Encrypting File System | TechNet Library

I just tested on OneDrive and it does the same as you found on DropBox.

If you want a second level of encryption on DropBox then you need to put your file (or folder) in an encrypted container. The easiest way would be to compress the file using 7-Zip and give it a password. I do this on both OneDrive and DropBox and it works fine as long as you only have a few files to do. If you had lots it would get rather cumbersome manually zipping/unzipping them I suppose.

There are some tools to automate this but I've not tried any of them - you could see here for some examples Top 5 Encryption tools for Dropbox, OneDrive, Google Drive | Next of Windows

As you have 10 Pro I'd recommend using bitlocker for local encryption not EFS it is safer and more secure.
See EFS, and why you shouldnt ever use it! - gHacks Tech News
and BitLocker - Turn On or Off for Operating System Drive in Windows 10 - Windows 10 Forums

And welcome to tenforums *Smile

 

Thanks for the detailed answer!

Please help be get a bit more of an understanding here. What I understand is that the file is encrypted in my disk. The Dropbox app asks from the operating system the contents of the file. The operating system detects that the user who runs the Dropbox app process has the necessary permissions, so before handing over the data to the app, it decrypts it.

If I am correct, which I might not be, this would end up with two files having the same name but different content. Wouldn't that be a problem for the Dropbox syncing process or it merely checks for same file name and date-creation/modification properties?

It's kind of not relevant with my original question but it would help me understand computers better!! *Smile

I'll use zip password protection. That was the method I was using so far but I always prefer using system tools if they do the job.

Thanks again!

 

If the user is authorized then the file will be decrypted when read from disk and encrypted when written. If the user is not authorized access will be denied so the kernel will give the file unencrypted (or not give it at all) to any process running under that user.

Source

No, you wouldn't get 2 files (at least not due to EFS). Either you can access the file or not.

I suppose that if you had a file in your dropbox folder that had been encrypted by another user on your local machine so your user (and the dropbox process) couldn't get access to it it might theoretically cause a problem. Dropbox would know there was a file of that name but wouldn't know any details (last modified date etc).

If there existed a file with the same name on another computer the same conflict resolution rules as normal would come into play. I'm not sure about Dropbox but OneDrive appends the machine name if it can't resolve a sync conflict.

I think you would have to try pretty hard for EFS to cause a problem with syncing - perhaps you could break it but I don't know.

The main issue is that it doesn't work for what you want as by the time dropbox (or any other process you are running) gets the file it isn't encrypted anyway.