It would be pointless to copy the ciphertext. When you copy the file to another computer, the content of the file is copied. When you try to read from an encrypted file, it is decrypted on the fly (and conversely encrypted when you write) by the operating system, so that applications don't need to be aware that some files are encrypted. As far as I know - but I'm not a Windows expert - what “unlocking” means depends on the version of Windows and whether a TPM is available, but the idea is that the encryption key cannot be retrieved without guessing your password (and, with a TPM, cannot be retrieved on a different machine even with your password).Īccess to encrypted files is transparent in the operating system. The encryption key is tied to your account and unlocked when you enter your account's password. If you want to create an encrypted container for transferring files to someone else, I'd recommend a compression tool that supports strong encryption. Instead, you're protecting the files where they sit against anyone else who gets their hands on your computer. Since the encryption is tied to the filesystem, it's not designed for sharing encrypted data.
This is useful if you ever put the disk into a different computer or reinstall Windows. Windows lets you back up your encryption key, where you export the key encrypted with another chosen password. The file can only be decrypted using the key I mentioned, which you never actually see. You can get to the ciphertext by reading the partition data raw, but there's no real advantage to doing that. If NTFS doesn't have the decryption key, it simply won't let you read the file. Since the encryption and decryption is done transparently by NTFS, you don't ever actually see the ciphertext. So logging in unlocks the key, which then makes your encrypted files available.
The encryption key is stored in your account profile encrypted with your login password (this is why there's the warning when you change your password). Windows built-in encryption is done transparently at the filesystem level.
0 kommentar(er)
