EFS files still accessible when key deleted


Carl Holland

After having encrypted a folder I exported the private key
to a floppy and deleted it from the system. The
folder/files are still accessible? Why?





Drew Cooper [MSFT]

EFS caches the key handle after a successful use. If you've
encrypted/decrypted/opened/etc. something, there will be a handle held open.
The file (the private key in the file system) is marked for deletion by the
export wizard, but is not actually gone until all handles are closed.

The easiest way to flush the EFS cache on Windows 2000 is to reboot. (The
less pleasant way is to flood the cache with other entries until yours is
bumped. Cache size IIRC is 100.) After the cache is flushed, you should
not be able to access those encrypted files.

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question