We have a web application (running in Apache Tomcat on a Windows Server 2008 machine) that stores most of its data in the file system. We are investigating ways to implement encryption for this data at rest. For our use-case, there is just a single folder that we would want to encrypt such that it can only be read/modified by the tomcat service user account. That single folder is currently around 20GB and is read-from and written-to by the application constantly.

Our first thought was to use Windows EFS, but this proved to be problematic. For reasons we have not been able to discover, a few hundred thousand files that we tried to encrypt were permanently corrupted. It seemed at though they were still encrypted, but the OS thought they were just garbled plain text files and did not give us the option to decrypt them. Since we were not able to identify the cause of this, we are uncomfortable relying on EFS.

The other alternatives we've been able to identify (so far VeraCrypt and Symantec File Encryption), though, all assume that there will be a physical user at the other end of the encryption who will be able to enter a passphrase to unlock the files. This won't work for a service account that will not login. Our application would lose access to the files any time the server restarts.

I can't imagine others haven't had a similar situation, but we're having a hard time identifying viable alternatives. Are there any recommended solutions for this type of use case?

  • 1
    Try running "CIPHER /C encrypted_file.txt" and see if the appropriate account is able to decrypt the data.
    – David A
    Apr 14, 2017 at 21:11
  • What I am noticing, though is that when I run that cipher command on another backup one of the files that was corrupted - it also has a recovery certificate tied to the admin, but one of the files that was originally left unharmed does not. Our sysadmin activated the encryption and I don't know the exact steps he followed, but assuming he encrypted the entire parent directory, what would cause some individual files to not have a recovery certificate when the rest do? Apr 14, 2017 at 22:12


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.