If you want to make sure that no one can read your files or folders without your permission, your best bet is to use one of Windows Vista’s encryption schemes, which scrambles data so that only those with the proper keys or passwords can read or use it.
Windows Vista has two types of encryption. The Encrypting File System (EFS) is a holdover from Windows XP, and it lets you encrypt individual files and folders. BitLocker Drive Encryption, new with Windows Vista, lets you lock down an entire computer so that only you can use it. In fact, if someone steals your laptop and you’ve encrypted it with BitLocker Drive Encryption, he won’t even be able to start it up, much less read the files on it.
BitLocker Drive Encryption
Encrypts entire drives so that data can’t be read, even if your computer is stolen (available only with the Enterprise and Ultimate editions of Windows Vista).
To open
Control Panel → [Security] → BitLocker Drive Encryption
Description
BitLocker Drive Encryption, new to Windows Vista, is the best way to keep all of your files safe from others. It works even if you have a laptop and it’s stolen. It’s designed so that your laptop or PC won’t even start up without your encryption key, so a thief will not even be able to boot your PC, much less read any of its files. BitLocker Drive Encryption encrypts all files on a drive, including those needed for startup and logon. By doing this, it ensures that a thief cannot start your system, log on to it, and then steal your encrypting password as a way to decrypt and read your files.
Tip
The EFS can encrypt individual files and folders, but it cannot encrypt an entire startup drive (Windows won’t work if you encrypted the files needed for startup and logon).
BitLocker encrypts all new files you add to your protected drive. The files are encrypted only when they are stored on the drive you’ve encrypted. If you copy them to another drive or computer, they are automatically decrypted. Shared files are encrypted when they are stored on the encrypted drive, and any user who has access to BitLocker-protected shared files will be able to use them as she would normally.
To turn on BitLocker Drive Encryption, choose Control Panel → [Security] → BitLocker Drive Encryption (see Figure 8-20) and click Turn on BitLocker. Alternatively, you can choose Control Panel → [Security] → BitLocker Drive Encryption. Follow the wizard that appears for turning it on; the instructions are straightforward. You’ll be prompted to save a startup key to a removable Universal Serial Bus (USB) device, unless you have the Trusted Platform Module (TPM) version 1.2 or higher. (See the next section, “BitLocker hardware requirements,” for details.) From then on, you’ll have to insert the USB device into your computer in order for it to start. In addition, you’ll create a recovery key or password so that you can always unlock BitLocker, in case you have problems starting up your PC.
Warning
Make sure not to skip the step for creating a recovery key or password—if you don’t create one, you could lock up your PC so that you can’t start it or recover any of your files.
BitLocker hardware requirements
BitLocker has specialized hardware requirements, which means that you may not be able to use it. It stores its encryption and decryption key in a device separate from your hard disk. Because of this, you’ll need one of the following in order to use BitLocker:
A computer that has TPM version 1.2 or higher. (TPM is a microchip in some new computers that supports advanced security features.) If you have hardware with TPM 1.2 or higher, BitLocker Drive Encryption will store its key on the chip.
A removable USB flash drive. In this case, BitLocker Drive Encryption will store its key on the removable drive. Keep in mind, though, that you’ll need to have the removable drive attached to your computer in order to use BitLocker Drive Encryption.
Warning
Although Microsoft mentions that you can use BitLocker if you have a USB flash drive, you do need to go through some steps to get this to work. See http://www.microsoft.com/technet/windowsvista/library/c61f2a12-8ae6-4957-b031-97b4d762cf31.mspx for details.
Even if you have one of the two aforementioned devices, though, you may not be able to use BitLocker Drive Encryption. You’ll also need to meet the following requirements:
You must have at least two partitions on your hard disk—one for the Windows Vista operating system (usually the C: drive), which BitLocker will encrypt, and another partition, which must remain unencrypted in order for your PC to start. This second partition needs to be both a primary partition and the active boot partition. If you have only one partition, you’ll need to create a second one with these properties. As of this writing, the only way to do this is to perform a clean install of Vista and use “Repair Your Computer” to run diskpart.exe, then partition a small (at least 1.5 GB) primary and active partition that appears before your C: drive. Microsoft may release a tool in the future to repartition an existing drive.
Your disk must be formatted with the NTFS filesystem. If it is formatted with FAT32, you can convert it to NTFS. See "FAT to NTFS Conversion Utility,” in Chapter 11.
You must have a BIOS that is compatible with the TPM and supports USB devices during computer startup. If you don’t have one, you’ll have to update the BIOS. If this is not the case, you will need to update the BIOS before using BitLocker.
Notes
To find out whether your hardware supports TPM, check the BitLocker Drive Encryption page (shown in Figure 8-20). There should be a TPM administrator link in the left pane. If the link isn’t there, you’ll need a USB flash drive. However, in some instances, a BIOS problem may prevent the link from appearing, even if your hardware supports TPM. If you think your hardware supports TPM but don’t see the link, check your documentation or the manufacturer’s web site.
If your PC doesn’t support TPM but you have a USB flash drive, the BitLocker wizard will require that you create a startup key that will be stored on the drive.
When your PC starts up and it’s protected with BitLocker, BitLocker checks your hardware for potential security risks—for example, changes to startup files, BIOS changes, or disk errors. If this occurs, it will lock your drive. You’ll need a BitLocker recovery key or password to unlock the drive. That’s all the more reason to create a recovery key or password when you first turn on BitLocker.
See also
"Encrypting File System (EFS)" and "NTFS Encryption Utility,” in this chapter, and "FAT to NTFS Conversion Utility,” in Chapter 11
Encrypting File System (EFS)
Encrypt files and folders on NTFS drives (Business edition and higher only).
To open
Right-click a file or folder → Properties → General → Advanced
Description
You use the Encrypting File System (EFS) to prevent unauthorized access to your data, and one of the features of the NTFS filesystem is its built-in support for automatic encryption of files and folders using “public key cryptography.” NTFS encryption is invisible, and encrypted files are opened as easily as decrypted files. The difference is that other users, either those who access your computer remotely or those who also log in to your computer under a different user account, will not be able to open or read encrypted files on your system.
Right-click on any file or folder, select Properties, and then click the Advanced button. The “Encrypt contents to secure data” option (shown in Figure 8-21) is used to instruct Windows to encrypt the selected item. If a folder is selected, all of its contents will be encrypted (you’ll be prompted about any subfolders); furthermore, any files added to that folder will be automatically encrypted as well.
The names of encrypted files show up in Windows Explorer in green rather than in the default black. (Compressed files show up blue.)
Notes
NTFS drives support both encryption and compression, but you cannot compress and encrypt a given file at the same time. If you attempt to encrypt a compressed file, Windows will first uncompress the file.
When you move an encrypted file to a nonencrypted folder on an NTFS drive, the file will remain encrypted.
If you encrypt some or all of the files on your drive and your hard disk crashes, or you encounter some other program that requires Windows to be reinstalled, you may not be able to access your previously encrypted files (assuming they’re still intact). You can avoid this by using the
/rparameter of the NTFS Encryption Utility to generate a “recovery agent key,” a cryptographic key that you can use to unlock files in the event of an emergency. You should be able to use this key to subsequently gain access to your encrypted files when necessary. For more information, go to Start → Help and Support and search for “cryptography.” See "NTFS Encryption Utility,” later in this chapter, for details.This type of file encryption is supported on NTFS drives only. If you want to encrypt files on a non-NTFS drive, you can either upgrade to NTFS or use a third-party file encryption utility such as TrueCrypt (http://www.truecrypt.org).
If you don’t want encrypted files to show up in green, open Windows Explorer and choose Organize → Folder Options → View tab and uncheck the “Show encrypted or compressed NTFS files in color” option.
See also