Windows Vista Security: Praxisorientierte Sicherheit für Profis

Using Compression and Encryption

|

687

You can expand a file or folder by completing these steps:

1. In Windows Explorer, right-click the file or folder that you want to expand and

then select Properties.

2. On the General tab of the related property dialog box, click Advanced.

3. In the Advanced Attributes dialog box, clear the “Compress contents to save

disk space” checkbox and click OK twice.

4. For a file, Windows Vista removes compression and expands the file. For a

folder, Windows Vista expands all the files within the folder. If the folder con-

tains subfolders, Windows Vista displays the Confirm Attribute Changes dialog

box, shown in Figure 19-19:

• To expand only the folder and the files it contains, select “Apply changes to

this folder only” and then click OK.

• To expand the folder, subfolders, and all related files, select “Apply changes

to this folder, subfolders and files” and then click OK.

Encrypting Files and Folders

You can use encryption to protect your files and folders so that only you can access

them regardless of the NTFS permissions assigned to those files or folders. The first

time you encrypt a file or folder, Windows Vista creates a personal certificate contain-

ing your encryption key. A personal certificate is similar to other types of certificates

used by computers in that it contains both private key and public key encryption

data. The certificate is extremely important. If it is damaged or removed from your

computer, you won’t be able to access your encrypted data.

Unlike NTFS compression, you can’t encrypt entire drives. You can’t encrypt com-

pressed files, system files, or read-only files either. If you try to encrypt compressed

Figure 19-18. Choosing the compression options

688

|

Chapter 19: Managing Disks and Drives

files, they are automatically uncompressed and then encrypted. If you try to encrypt

system files, you’ll get an error message.

The Windows Vista component that handles encryption is called the Encrypting File

System (EFS). EFS encrypts files and folders using an encryption key that is automat-

ically generated and unique for each person that uses encryption on your computer.

When you encrypt a file or folder, the associated data is converted to an encrypted

format so that only you can access the file or folder.

By default, you are the only person who can access your encrypted files and folders.

However, as you might expect there are some caveats. If your computer has any

assigned recovery agents, those recovery agents have the authority to decrypt any

encrypted files and folders on your computer. You can think of a recovery agent as

having a master key. Additionally, you can grant a person the right to access your

encrypted files and folders. When you do this, this person’s encryption key is added

to the file or folder’s encryption data, allowing the person to access the file or folder

just like you can.

Encrypting a file or folder

You can encrypt a file or folder by completing these steps:

1. In Windows Explorer, right-click the file or folder that you want to encrypt and

then select Properties.

2. On the General tab of the related property dialog box, click Advanced.

3. In the Advanced Attributes dialog box, select the “Encrypt contents to secure

data” checkbox and then click OK.

4. For an individual file, Windows Vista marks the file as encrypted and then

encrypts it. If the file is in a folder that is not encrypted, Windows Vista displays

the Confirm Attribute Changes dialog box:

Figure 19-19. Choosing the uncompress options