Disk Encryption

Windows 8 supports a number of disk encryption technologies, which prevents thieves from accessing sensitive data should your computer be physically stolen: If the thief removes your hard drive and attaches it to a different computer, any encrypted files cannot be read even if the thief figures out a way to access the hard drive’s filesystem. There are two major technologies at play here: the older Encrypting File System, or EFS, and BitLocker, a more modern and easily managed system.

EFS

When files are copied or moved out of an encrypted folder, the encryption is retained unless you move them to a location where encryption is not supported, such as to another machine on your home network.

EFS, while still available in Windows 8, has been somewhat deprecated. It was created as a way to encrypt individual files or, more commonly, a folder. With the latter approach, encryption works for both new files as well as those that were present when the folder was encrypted. That is, as you add new files to the encrypted folder, those files are automatically encrypted.

To encrypt a folder with EFS, right‑click it and choose Properties from the menu that appears. Then, in the Properties window that appears, click the Advanced button. In the Advanced Attributes window shown in Figure 14‑4, select the option titled Encrypt contents to secure data.

Figure 14‑4: Encrypting an individual file or folder is easy and generally quite fast.

When you click OK (or Apply), you’ll be asked to make the change to the folder only (which includes all of its contained files) or to the folder and any of its subfolders and their contents. Windows will encrypt the appropriate items and immediately suggest that you back up your encryption certificate and key, which is required for recovery should you try to access the folder contents later via a different PC or future reinstall of Windows. Microsoft recommends backing these items up to removable media. But we’d go a step further and make copies in multiple places, including cloud storage like SkyDrive.

Encrypted folders are easily identified later: When you open an encrypted folder, you’ll see that all of the enclosed files have a green (rather than black) filename. This is a visual indicator that they’re encrypted.