0

I'll start off with the assurance that I have all the EFS certs safely in hand, and that is not what I'm asking about below. Assume I have that part taken care of.

I'm trying to backup a some mixed (EFS 10% /nonEFS 90%) files, but want to keep the EFS files encrypted so the backup is not a single point of failure. I found the robocopy /EFSRAW switch, but was hoping there was an archiver (tar, pkzip, winrar) that could do the same type of operation.

I imagine there is some meta-data associated with EFS files beyond just their certificate. This is likely an EFS like ACL of some sort, as best I can determine. So the fact that robocopy can pull this off on an NTFS to NTFS clone seems to imply that it's possible. An archiver would need to account for the EFS-ACL and keep track.

Here's a list of workarounds available and why they aren't what I'm after:

  1. Archive in unencrypted format - Bad since the archive could be lost with all the secrets in it.
  2. Just encrypt whole archive - Bad because 90% of my files don't need this, only the ones with the EFS attribute.
  3. Transcode EFS encryption to GPG encryption - Fair, but seems a lot of kluge and hackish.
  4. Robocopy files to a VHD then compress it - OK, but single-file extractions would require the whole VHD to be blown up.

Not sure how popular EFS is, but I love it, and wish it had more tooling and support.

Thoughts on a solution, since I think my previous attempts fall short.

Dan
  • 211
  • 1
  • 3
  • Properly encrypted data, and AFAIK EFS is proper, can't be compressed http://blogs.technet.com/b/seanearp/archive/2008/05/15/why-can-i-not-compress-and-encrypt-a-folder-in-windows.aspx so I'd say go with the VHD. – dave_thompson_085 Apr 06 '16 at 04:51
  • @dave_thompson_085 true, but my content is mixed... 90% non-EFS, 10% EFS. I'm probably leaning towards the GPG approach. – Dan Apr 06 '16 at 04:59

0 Answers0