What happens if the computer's integrity is confirmed Let's suppose that someone stole our laptop.
One of the tasks have been loggers to protect laptops from theft.
This does not mean that someone cannot steal her laptop.
It means that if someone has stole it you can't read the data on the disk.
Someone who steals our computer will probably turn it on.
Bill Lockyer will be invisible to them.
The key will be reading decrypted with the TPM module then it will be decrypted with the next key.
And finally the entire disk will be decrypted.
They will see the log in window if her password is easy to guess and the attacker enters it.
He has access to decrypted data all investment and time devoted to encryption is useless.
What then does bit locker protect from it protects if someone has physical access to the computer.
You will not be able to run it under the control of another system other than the original details of
the TPM modules will not agree.
The attacker will not start the computer from the old cracked CD like we did previously.
For the same reason the attacker will not copy the Sam security and system files because they won't
even know where they are on the drive.
He also can't really and he can't change their content.
Bit locker although it's not very invasive and invisible is very effective as long as we use difficult
passwords to guess.
Since we have an encrypted disk why encrypt individual files why do we still need ferse once we have
an encrypted disk we're protected against local attacks therefore bit Locker's often enabled on servers
as well as laptops in order to additionally ensure the safety of these critical devices.
What will happen if we would like to exchange confidential data with other users Bill locker and true
crypto will not allow it in any way.
We need to have a solution operating in a higher layer not between a physical and logical does but between
a folder and what the operating system sees the folder content your first comes to our aid
if it is available since Windows 2000.
The mechanism of action is as follows.
To encrypt something we need a key.
If we don't have it then when we try to encrypt the first file or computer reports on our behalf a request
to issue the certificate with a key the request will be reported to the domain keyed distribution center.
If such does not exist then our computer will issue us a certificate
a public key will be in the Received certificate a private key is also linked with the certificate which
we write and the user profile.
This is very important deleting a user profile.
It's loss damage or resetting the password involves loss of the FS key.
Now having private and public keys we can generate a file encryption key or FAQ with this symmetric
key we can encrypt our file to decrypt such a file.
We need to have access to the effect queue which we just talked about.
Think about it as a session key re-encrypt the session key with the previously received FS key with
the same FNQ we can also encrypt the additional ESF keys.
This is what is frequently done.
These are the keys of persons with whom we'd like to exchange an encrypted file or key recovery agent
this person will be able to decrypt the key and thus decrypt encrypted files.
If something happens to our profile
a modular structure of the operating systems was used with the ESF an additional component was introduced
between the layers.
In this case it's the NTFS driver layer.
In other words the new technology file system
the encryption itself runs completely automatically in a moment we'll see how does it look from the
user's perspective.
In order to ensure security and additional NTFS driver component first checks whether we have all the
necessary keys for example is the user profile loaded next it generates a key encrypting it for security
then a backup copy or a temporary file is created.
The new file is located in the same folder as the file that we want it to encrypt the content of the
newly created file is encrypted.
The file is marked as encrypted when transferring to it.
Data from the original file.
The data itself is also encrypted.
This is what happens when selecting the file encrypt attribute the original file will be cleared if
everything.
Well so far.
The content of the temporary file is transferred back to the original file.
The content is encrypted and remains so in the meantime.
The original file was marked as encrypted saving the information about the encrypted file and the entire
operation.
The temporary log file is automatically deleted.
The procedure is repeated if we have recovery agents or persons whose kids we write in the file.
The final effect is that we have an encrypted file and then the DDL and Diyar fields of this file encrypted
keys are placed there as many keys as there are people who have shared access to the file.
We are the one that encrypted the file the recovery agent and the person we want to share the file with
the decryption procedure is very similar.
First we must have access to the key to do this.
We check what's in the ZDF and Diarra fields of the file.
We read the contents of these fields meaning the encrypted keys.
Then we decrypt them
having the decrypted key.
We can try to decrypt the file itself and transfer its contents to an application for example display
the text file in the notepad.