Editing Encrypting File System (section)

==Basic ideas==
{{Unreferenced section|date=February 2010}}
When an [[operating system]] is running on a system without file encryption, access to files normally goes through OS-controlled user [[authentication]] and [[access control list]]s. However, if an attacker gains physical access to the computer, this barrier can be easily circumvented. One way, for example, would be to remove the disk and put it in another computer with an OS installed that can read the filesystem; another, would be to simply [[reboot]] the computer from a boot CD containing an OS that is suitable for accessing the local filesystem.

The most widely accepted solution to this is to store the files [[Encryption|encrypted]] on the physical media (disks, USB pen drives, tapes, CDs and so on).

In the Microsoft Windows family of operating systems EFS enables this measure, although on NTFS drives only, and does so using a combination of [[public key cryptography]] and [[symmetric key cryptography]] to make decrypting the files extremely difficult without the correct key.

However, the cryptography keys for EFS are in practice protected by the user account password, and are therefore susceptible to most password attacks. In other words, the encryption of a file is only as strong as the password to unlock the decryption key.