0

I'm trying to combine EFS encryption with VeryCrypt, system encryption.

With EFS I can choose specific files/folders instead doing a whole drive encryption, so that is the reason I use it.

I haven't deleted my certificate because I don't want to enter the password each time I log in for my encrypted folders/files. Besides I wish to encrypt files in %appdata% so they need to be decrypted by Windows once I log in.

I use VeraCrypt system encryption, so there is a password to be able to proceed with the boot. This is a security measure I combine, as Windows login password is crackable.

My question: Since my certificate is on the drive and in %APPDATA%\Microsoft\SystemCertificates (not encrypted so Windows can decrypt password less at login. And since I haven't deleted my certificate, it's stored there. My cert is backed up on a USB.), if my drive gets out of the hand, can someone extract %APPDATA%\Microsoft\SystemCertificates to use it on a different system mount my c: Windows drive, and be able to view all my encrypted files I have from EFS? Or will it ask for the certificate password during this procedure?

Improve this question
1
  • I believe Windows encrypts the certificate in your store using your Windows login credentials. Therefore, somebody gaining direct access to the certificate cannot use it without your password. Of course, ensure you're using a strong password for your Windows account (ideally 128 bit strength in entropy).
    – SilverlightFox
    Commented Dec 8, 2015 at 9:20

1 Answer 1

Reset to default
1

If you are using VeraCrypt to protect the partition that your Windows installation is on then an attacker would have to overcome that encryption before they could try to get your EFS private key. If you're using a strong password for VeraCrypt that possibility should be low.

However, if an attacker gets through VeraCrypt and gains access to your unencrypted Windows partition then they could attempt to crack your account login password. Once they do that they can log into your account and have access to your EFS private key and thereby all your EFS protected files. There may be other ways to extract your private key, but this seems to be the easiest route.

Edit: removed claim that admin changing user password would allow access to private key. See comments below.

Improve this answer
6
  • Only the system partition, the system reserved, active, is encrypted on c: where Windows is, and not all that drive, this is what I assume, haven't proceeded with it actually yet... There is another option Encrypt the whole drive, this will encrypt all partition on my Windows disk, including Windows (recovery, sys), which I don't want. So I can go ahead with the first option Encrypt the Windows system partition right, this will ask for a password on boot, and this method as you said will not expose any Windows files, even though someone tries to extract files from the drive on another PC.
    – nicoX
    Commented Dec 7, 2015 at 19:05
  • @nicoX I'm not familiar with VeraCrypt so I don't know what limitations or impacts come with using that to encrypt different OS directories of a drive. If they say they support that configuration then you could give it a try. I believe you need to focus on using it to encrypt the Windows and Users directory/subdirectories to prevent someone from attacking Windows and accessing your EFS private key.
    – PwdRsch
    Commented Dec 7, 2015 at 19:35
  • @nicoX Correction: looks like you actually need Documents and Settings encrypted and may not need the Users directory.
    – PwdRsch
    Commented Dec 7, 2015 at 21:46
  • If you have multiple partitions—e.g. one for your data and one for your operating system—then choose the second option “Encrypt the whole drive.
    – nicoX
    Commented Dec 7, 2015 at 21:50
  • EFS doesn't work if you change the Windows password when not logged in (e.g. an attacker or another administrator user). Therefore you're protected in this scenario.
    – SilverlightFox
    Commented Dec 8, 2015 at 9:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .