Encryption - EFS vs. Bit Blocker

[Jake]

I'm sure this has been asked before but I couldn't find any threads
discussing it..

I've been reluctant to switch over from a desktop machine to a laptop
for fear of someone stealing it and getting access to all my personal
files. However, I just purchased a new laptop with Vista Business
installed and I like it and am considering making the move from a
desktop to a laptop as my primary machine.

I've got a new Lenovo 3000 N200.


So how do I protect my personal files from being accessed if someone
were to snatch my laptop from my car ?


I've been reading and reading and reading about EFS and BitBlocker. I
know I will need to upgrade to Ultimate for BitBlocker (which brings up
other questions about upgrading) but I'll stick to the encryption
question here.


Would EFS be sufficient for protecting my personal files?

Is there anyway someone can take the hard disk out of my laptop, put it
in another machine as a secondary drive, or installed into one of those
portable drive shells, take ownership of the drive and get access to my
files?

Is it practical to encrypt the entire Documents folder from a
performance perspective?


What practices are required? I've read numerous help files and KB
articles and I'm totally confused now about certificates and encryption
keys.. Do I need to back them both up? From what I've read, there are
backup instructions for them both yet one contains the other so I can't
understand why backing them both up is necessary, or for that matter
even mentioned in the help files - unless it's to create as much
confusion as possible.


If I backup my files and restore them, what EXACTLY do I need to gain
access to them again on another PC or a new PC? How many certificates
and keys are involoved?

I read something about taking the private key off the computer when
unattended since it would aid in someone getting access to the files.
THIS I believe is in a MSFT KB about "best practices".. Is that REALLY
necessary? Is there another "non-private" type of key also?

Whew!!! I'm Dazed & Confused but that's normal after reading Microsoft
(marketing fluffed) literature on product features..

Are there any other resources that help unravel all this since Microsoft
as failed to do so for me... Something specific to storing personal
files on a laptop?

Thanks
Bryan

 

[Steve Riley [MSFT]]

Check out the new Data Encryption Toolkit at
http://www.microsoft.com/technet/security/guidance/clientsecurity/dataencryption/default.mspx.
It's got some good information to help you understand the differences
between EFS and BitLocker and how they can protect your information.

For BitLocker, you'll need Vista Business with Software Assurance, Visa
Enterprise, or Vista Ultimate.

For EFS, yes protecting your "My Documents" folder is a good start. There
are others you should protect, too; the Data Encryption Toolkit has a
utility that will enable encryption on all the relevant places in your
computer.

 

[Jake]

Thanks Steve..

I'll check out that site. I may have already stumbled upon it though..

What about encrypting the entire user folder under C:\Users for my user
account?

I'm a MS Alumni so I'm pretty sure I can get Ultimate for cheaper price
than unlocking it through the online upgrade. Do you know if I can just
use the product key (change product keys) from a retail copy of Ultimate
to upgrade my OEM Business edition? I'm not sure how all that works..

Thanks
Bryan

 

[Steve Riley [MSFT]]

We haven't tested the scenario you mention--encrypting an entire
C:\Users\<myuserfolder>, so I can't predict what would happen. Some apps
might have installation troubles, maybe? It's best to go with the guidance
in the toolkit, we have tested that.

I don't know about the licensing question...

 

[Guest]

Doesn't the Lenovo have bios level options for a Power-On Password and Hard
Drive password? My T61 does and when enabled the system will not power on or
go into the bios unless the password is entered. The Hard Drive password
locks the hard drive to a password, even if it's removed from the system to a
new one.

Just like anything make sure you understand the options before implementing
them, because if the passwords are forgotten then you are pretty much out of
luck.

 

[RobC]

Doesn't the Lenovo have bios level options for a Power-On Password and Hard
Drive password? My T61 does and when enabled the system will not power on or
go into the bios unless the password is entered. The Hard Drive password
locks the hard drive to a password, even if it's removed from the system to a
new one.

Just like anything make sure you understand the options before implementing
them, because if the passwords are forgotten then you are pretty much out of
luck.

 

[RobC]

Doesn't the Lenovo have bios level options for a Power-On Password and Hard
Drive password? My T61 does and when enabled the system will not power on or
go into the bios unless the password is entered. The Hard Drive password
locks the hard drive to a password, even if it's removed from the system to a
new one.

Just like anything make sure you understand the options before implementing
them, because if the passwords are forgotten then you are pretty much out of
luck.