This is about the Microsoft Windows file system, for the old IRIX file system, see EFS (IRIX).

The EFS or Encrypting File System is a file system available in Microsoft's Windows 2000, Windows XP, and Windows Server 2003 operating systems.

The technology allows files to be stored encrypted on NTFS partitions to protect confidential data from attackers with physical access to the computer.

Why and how

User authentication and access control lists can protect files from unauthorized access while the operating system is running, but are easily circumvented if an attacker gains physical access to the computer.

The only solution is to store the files encrypted on the disks of the computer. EFS does this using public key cryptography, thus ensuring that decrypting the files is practically impossible without the correct key.

It should be noted, though, that EFS does not prevent brute-force attacks against the user account passwords. In other words, file encryption doesn't provide much protection if the account password is easily guessed.

External links

• EFS in Windows 2000
• Overview of EFS in Windows XP