Windows 10: Question about Windows Encrypting File System (EFS)

Hi
I've been playing around with EFS but I cannot currently test this one thing that popped to my mind.
I have a laptop with an SSD (Local disk C:\) and a HD (Local disk D:\).
Windows installed on SSD, personal files kept on HD.
Windows is protected with a user account with password.
I used EFS (not BitLocker, just EFS) on some files on the HD.

If my laptop gets stolen, and if the thief removes that HD and connects it to another computer that he has access on, if he uses a Linux live USB/CD to boot, what stops him from copying the encrypted files from my HD and then being able to access them?
I'm assuming that he won't be asked for Windows password since that stays on the SSD and he removed the HD and put it on another computer...

If anyone haven't played around with EFS, once you get access to the encrypted files, nothing stops you from copying them to another media and then pasting them to another computer and access them.

:)

 

Win 10 pro EFS Encrypting File System Problem (Dell)

Hi,

Thank you for being a part of Windows 10.

I appreciate you for providing details about the issue and we are happy to help you.

I suggest you to start the Encrypting File System (EFS) Service and check if it helps.

Follow the below steps:

• Press Windows key + R from the Keyboard.
• Type services.msc and hit Enter.
• Search for Encrypting File System (EFS) Service.
• Double click on Encrypting File System (EFS) Service and click on
  Start button.
• Click on the dropdown list and set the Startup type to
  Automatic.

If the issue still persists then, I suggest you to post the same question in TechNet forum for further assistance with this issue. Follow the below link to post your question in TechNet forum.

Technet forums

Kindly let us know if you need any further assistance with Windows. We are glad to assist you.

Thank you.

 

Question about Windows Encrypting File System (EFS)

You are able to copy the EFS encrypted files because are are logged in using the user account that has access to those encrypted files. When you copy the files to another location, Windows decrypts the files on the fly to place them on a non-encrypted device. It's been a few years so forgive my lack of memory on all details, but I think that if you were copying to say a thumb drive that is formatted with NTFS the file would remain encrypted since that destination is capable of storing EFS encrypted files.

So, if a user connects the HD to another system, they would not be logged on with the correct credentials and as a result the file would remain encrypted and inaccessible to them. I think that they may be able to copy the file, but it stays encrypted and inaccessible.

Easy way to test this:

Set File Explorer to show EFS encrypted files in an alternate color.
Encrypt a test file on your computer.
Format a thumb drive with NTFS.
Copy the EFS encrypted file to that thumb drive. It should show in the alternate color indicating it is still encrypted.
Move that thumb drive to another machine that you have not added you EFS encryption certificate to.
The file should remain inaccessible (it won't decrypt).

 

Question about Windows Encrypting File System (EFS)

Here is a good tutorial on the topic:

Encrypt Files and Folders with EFS in Windows 10