Q: NTFS Encryption

Giganews Newsgroups
Subject: Q: NTFS Encryption
Posted by:  G. Ralph Kuntz, MD, MS (g…@usa.net)
Date: Wed, 14 May 2008

Suppose someone wanted to set up a database and the DB starts as a
service when the computer is booted. The database directories are
encrypted using NTFS encryption.

As I understand it, the secret key for the encryption is "protected"
using the password of the account who originally encrypted the files
(the encryption key is itself encrypted with the user's password).

When the DB service is created, the user enters the DB password so
that the serrvice can start and can decrypt its files, without the
user having to enter the password every time the machine is rebooted.

That DB password MUST be stored somewhere on the hard drive, otherwise
the encryption key could not be recovered and the files would be
unreadable.

Now I understand that if you removed the hard drive from the original
computer and placed it in a new computer as a secondary drive, if the
new computer is also running Windows, you will not be able to recover
the DB password and so will not be able to read the DB encrypted
files.

But, support you placed that drive in a Linux machine. Could you not
find the DB password (it MUST be some place on the drive), and with
that, decrypt the DB encryption key and get access to the encrypted
files?

Where is the flaw in my logic?

Replies