Windows 7: EFS and Windows backup (system image) - Certificates not included?

Question

I just encrypted my C:\Users\Username folder with EFS. I also backed up my EFS certificate (.pfx). Now I wanted to do a backup of my computer on an external HDD. I want to use the integrated Windows update for that. I chose the option to only include an image backup of the whole disk and now comes the problem: It's telling me the EFS certificate won't be included in the backup which doesn't make any sense to me. Shouldn't the image backup be a 1:1 copy of the disk? That would mean it's the whole windows installation with all my certificates? Without the certificate I don't even know if I could boot the system because of the encrypted user folder...

Solution

As long as you have the files and a backup of your certificate (pfx file) you can always decrypt the files.

The warning you get when setting up the backup is not correct, it does not apply when you do a system image backup (as long as your user directory is on the C drive along with the Windows files). The warning applies only when you just select some individual files in the backup. I think they always display the warning when EFS is used.

I just set up a Win7 box, encrypted a file, then backup it up using just the 'system image'.

On another computer I booted from the DVD and used the backup to restore the OS.

I logged in as my old user and had access to the encrypted file.

An encrypted User directory does not prevent Windows from boot up, but I don't think it's a good idea to encrypt your whole user directory. I would limit it to the documents folder where you have your 'secret' files. Remember that both your registry hives (C:\users\username\NTUSER.DAT*) and the EFS certificates (C:\Users\username\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates*) are inside your user directory. I'm actually surprised EFS works when you encrypt the whole user directory.

Comments

[Torben]

Thanks a lot. That warning didn't seem right to me. Good to know it's not true. I chose to encrypt the whole user folder, because some programs store personal information in the AppData folder. For example Thunderbird stores the mails there. Also my current file structere has a lot of personal files outside of the documents folder. Windows is smart enough to not allow NTUSER.DAT to be encrypted. Other folders which can't be encrypted are folders like CryptnetUrlCache, Credentials and Protect.

[Torben]

Yes, I only wanted to write an answer first. Thanks!