Backup fails when encrypted file copied from NTFS to FAT

[Tamil]

Backup fails when encrypted file from NTFS is copied to FAT file system.

[admin]

Backup fails when encrypted file from NTFS is copied to FAT file system.

What happens? Error message?

[Tamil]

What happens? Error message?

---------------------------
XYplorer
---------------------------
Backup from 1/11/2007 8:28:35 PM

Source: Y:\
Target: Z:\

324 copied
0 overwritten
0 not overwritten

0 failed (source too long)
0 failed (target too long)
1291 failed (for other reasons)

1615 total

---------------------------
OK
---------------------------

[admin]

Okay, thanks.

Now what should happen? I guess NTFS encryption is not compatible with FAT.

[j_c_hallgren]

I guess NTFS encryption is not compatible with FAT.

That's my understanding, although I've always used a FAT system...so any encryption on FAT is via a user installed product, AFAIK.

[mwb1100]

Now what should happen? I guess NTFS encryption is not compatible with FAT.

I think that typically what happens is that the file ends up on the FAT volume in a non-encrypted state. At least that's what's documented:

http://www.microsoft.com/technet/securi ... 1.mspx#EEG

To copy a file or folder on the same computer from an NTFS partition in a Windows 2000 volume to a FAT partition. Copy the file or folder in the same manner as an unencrypted file. Use Windows Explorer or the command prompt. Because the destination file system does not support encryption, the copy is not encrypted.

[admin]

Now what should happen? I guess NTFS encryption is not compatible with FAT.

I think that typically what happens is that the file ends up on the FAT volume in a non-encrypted state. At least that's what's documented:

http://www.microsoft.com/technet/securi ... 1.mspx#EEG

To copy a file or folder on the same computer from an NTFS partition in a Windows 2000 volume to a FAT partition. Copy the file or folder in the same manner as an unencrypted file. Use Windows Explorer or the command prompt. Because the destination file system does not support encryption, the copy is not encrypted.

I see it but I can't believe it. You plug a FAT device into a computer and decrypt data by copying them to your device? Stealing has never been simpler... well, I probably did not get it right.

[mwb1100]

You plug a FAT device into a computer and decrypt data by copying them to your device? Stealing has never been simpler...

Not exactly stealing, since it will only get decrypted if the user has access to the correct keys for decryption. However, it is certainly an avenue for unwittingly leaving a file decrypted.

But it's a similar situation to where you're using a TrueCrypt container or an encrypted Zip archive - if you copy a file out of the container/archive it's no longer protected.

[admin]

You plug a FAT device into a computer and decrypt data by copying them to your device? Stealing has never been simpler...

Not exactly stealing, since it will only get decrypted if the user has access to the correct keys for decryption.

You mean you are asked for a key before copying? (Yep, I'm totally clueless in this area.)

[mwb1100]

Well, I happened to have a USB thumbdrive lying around so I could test this easily.

I can repro the error. Some additional information - when using a normal drag-n-drop (from XY to and Explorer window of the FAT destination) I get this dialog box:

Code: Select all

The file 'test.txt' cannot be copied or moved without losing its encryption.

You can choose to ignore this error and continue, or cancel.


     |  Ignore  | Ignore All  |  Cancel  |

I don't think this dialog was displayed back in the Win2K era, so MS has apparently done something to prevent users from unknowingly decrypting files (that's good). But in the process the reason for the failure in the XY backup operation gets lost in translation.

[mwb1100]

You mean you are asked for a key before copying? (Yep, I'm totally clueless in this area.)

No, EFS (Encrypted File System) is an NTFS feature that works pretty seamlessly. To encrypt a file or folder you simply check an attribute box (you need to press the advanced button on the property sheet). The key is automatically generated and stored by Windows in something called the Protected Storage Service so it's accessible only to that particular user.

This is the simple overview - things can be made considerable more complex in an Active Directory domain. But for testing this all you need is a version of XP/Vista that supports EFS (I think the 'Home' variants do not). Open the properties page of a file, go to the Advanced dialog and check the box that says this file should be encrypted. That's it.

[admin]

EFS (Encrypted File System) ...

Thanks!

[admin]

EFS (Encrypted File System) ...

Thanks!

Okay, XY's Backup function -- contrary to the Copy function -- does not use the Shell but a lower level API named CopyFile to do the job. MS documentation says:

XP, Vista: When CopyFile is used to copy an encrypted file, it attempts to encrypt the destination file with the keys used in the encryption of the source file. If this cannot be done, this function attempts to encrypt the destination file with default keys, as in Windows 2000. If neither of these methods can be done, CopyFile fails with an ERROR_ENCRYPTION_FAILED error code.

Windows 2000: When CopyFile is used to copy an encrypted file, the function attempts to encrypt the destination file with the default keys. No attempt is made to encrypt the destination file with the keys used in the encryption of the source file. If it cannot be encrypted, CopyFile completes the copy operation without encrypting the destination file.

So you encountered the ERROR_ENCRYPTION_FAILED error, which however is currently not correctly reported by XY's backup log. I'll change that.

Under Win2000, you should get the file copied and decrypted. Can anybody confirm this?

I currently do not see a way to get the file copied and decrypted under XP/Vista. Hmm.
UPDATE: got it: CopyFileEx... easy

[admin]

Backup fails when encrypted file from NTFS is copied to FAT file system.

Fixed. Thanks!

[PeterH]

Backup fails when encrypted file from NTFS is copied to FAT file system.

Fixed. Thanks!

That means? If you cannot store it encrypted (i.e. on FAT) you store it decrypted? And if so: do you give info to the user?