EFS & full computer backups

[Richard]

Hi,

If I have an external USB disk & create a full backup image on it, in Vista
Ultimate (using the built in image software), can I encrypt it using the EFS
& be able to restore it in the normal way via the repair option?

 

[Guest]

If I have an external USB disk & create a full backup image on it, in Vista

Ultimate (using the built in image software), can I encrypt it using the EFS
& be able to restore it in the normal way via the repair option?

Normally, no. You would have to format the USB disk using NTFS, which is
possible but not the default. Once you do that, you will be able to use EFS.
The problem is that if your computer goes south and you lose your user
account and associated EFS certificate, you won't be able to decrypt the
files unless you have the recovery keys. If you are in a domain environment
your keys would be stored in AD, in which case the concern is much lower.

 

[Alun Jones]

Normally, no. You would have to format the USB disk using NTFS, which is
possible but not the default. Once you do that, you will be able to use
EFS.

If this is an external hard drive, you may have already formatted it as
NTFS.

The problem is that if your computer goes south and you lose your user
account and associated EFS certificate, you won't be able to decrypt the
files unless you have the recovery keys. If you are in a domain
environment
your keys would be stored in AD, in which case the concern is much lower.

And, if you're in a non-domain account, you can always export your
certificate _AND_ private key to a PFX file, so that you can later recover
the data that you've encrypted.

There's an article with some details on preparing to recover data from EFS
at http://www.microsoft.com/technet/community/columns/secmvp/sv1206.mspx

Alun.
~~~~

 

[Richard]

Hi, thanks for the replies.
I know abour EFS certificate backups etc & am happy with that.
My question is whether Vista Ultimate can read a complete restore backup
file which is encrypted with EFS on an NTFS volume at the recover console &
perform a complete restore?
This is using the complete restore option in Vista itself, not with 3rd
party software.

 

[Guest]

I highly doubt that it can do that at the recovery console. I do not think
you have any way to provision the EFS keys into it. I'd be very interested in
your results though.