How does a third party file encryption get along with OS native file encryption?

Question

I sort of understand what is meant by no security level beyond "cannot break it" but I have a much more involved question about having more than one form of encryption on a computer at once.

Suppose your using Windows 7 and as we all know Anyone can encrypt and decrypt right within the explorer menu when clicking on any file or folders.

But now lets say you want to install for example a separate encryption program (something like TrueCrypt) and you've already encrypted many of your files using Windows.

Would a program like TrueCrypt simply encrypt these (already encrypted by Windows) files or would a user need to decrypt them in Windows first before they could run a program like TrueCrypt?

Hopefully this isn't too confusing a question but I still think its a good one considering this topic of discussion.

Answer 1

TrueCrypt
TrueCrypt creates a disk object by inserting itself as a translation layer above an existing container - typically a partition or an entire disk, sometimes a file which will therefore contain a disk image. You then format that disk created by TrueCrypt using NTFS or FAT or EXT4 or whatever you want. TrueCrypt neither knows nor cares about the files on the disk^[1], it just encrypts the disk raw. Used space, free space, deleted files.. everything. It's the disk that's encrypted, and therefore any files on it are by extension also encrypted because they're in an encrypted container.

NTFS
Windows built-in encryption is based on NTFS -- the filesystem used by Windows. NTFS takes an existing disk and decides where on it to store files. It keeps track of used blocks, file names, the location of file contents, file fragmentation, all of that. It's the set of rules used to decide where on the disk a given file goes.

Built in to the NTFS spec is the idea of encryption. Key handling is done through windows, but the important point is that the encryption happens transparently when the file is stored to disk. If the file is marked as encrypted, then NTFS will transparently encrypt/decrypt the file as it's reading or writing from the disk.

Together
You can create a TrueCrypt container and format it with NTFS. In that sense, the entire filesystem will be encrypted, but Windows won't know that. All Windows sees is the disk object exposed by TrueCrypt. It doesn't know (nor does it have to know) that TrueCrypt is transparently encrypting that data before writing it to disk. But it is.

Within that NTFS filesystem in the TrueCrypt container, you an also instruct Windows to encrypt the file. It tells the NTFS filesystem that this file is encrypted, and NTFS will dutifully encrypt the file.

Now the file appears to be in plain text to the user, but actually when it's stored to disk, the filesystem is transparently encrypting it. And then again when those encrypted bits are actually written to the physical disk, TrueCrypt is getting in there and encrypting those data blocks again, so the file is encrypted, and the disk that the file is on is encrypted.

Both are done transparently, and the whole process just works. Obviously you'll need both keys to get to the actual file data. The TrueCrypt key is your TrueCrypt password, while the Windows NTFS key is typically an x.509 private key encrypted with your Windows login password.

---

^[1]: Not entirely accurate, but accurate enough for this discussion.

Answer 2

TrueCrypt would encrypt the encrypted files again. You now have two layers of encryption. To decrypt the files, you run TrueCrypt first to get the Windows encrypted files and then you run the Windows decryption to get the original data.

Encryption turns binary data into a different form of binary data. It doesn't care about the meaning of the original data. Whether it's plaintext or binary data already encrypted with another algorithm.

Answer 3

Think of it like a box within a box. The OS encrypted files would be in a box that would need to be made available to the third party encryption system. They would then be encrypted again within the third party system, but the third party system has to put a file somewhere. If it puts that files within the OS encrypted volume, then the encrypted file from the third party will also be encrypted by the OS.

So going back to the boxes example, to encrypt a file that is already encrypted by the OS, the third party software takes the file out of the OS's box, puts it in a box of its own and then can put its box back inside the OS's box. This way someone needs access to both decrypt on the OS and decrypt in the third party volume (in that order) in order to be able to get to the contexts inside the nested boxes.