What’s the Difference Between BitLocker and EFS (Encrypting File System) on Windows?

[Batu69]

Windows 10, 8.1, 8, and 7 all include BitLocker drive encryption, but that’s not the only encryption solution they offer. Windows also includes an encryption method named the “encrypting file system”, or EFS. Here’s how it differs from BitLocker.

 

This is only available on Professional and Enterprise editions of Windows. Home editions can only use the more restricted “device encryption” feature, and only if it’s a modern PC that shipped with device encryption enabled.

BitLocker is Full Disk Encryption

BitLocker is a full-disk encryption solution that encrypts an entire volume. When you set up BitLocker, you’ll be encrypting an entire partition — such as your Windows system partition, another partition on an internal drive, or even a partition on a USB flash drive or other external media.

 

It is possible to encrypt only a few files with BitLocker by creating an encrypted container file. However, this container file is essentially a virtual disk image, and BitLocker works by treating it as a drive and encrypting the entire thing.

 

If you’re going to encrypt your hard drive to protect sensitive data from falling into the wrong hands, especially if your laptop is stolen, BitLocker is the way to go. It’ll encrypt the entire drive and you won’t have to think about which files are encrypted and which aren’t. The entire system will be encrypted.

 

This doesn’t depend on user accounts. When an administrator enables BitLocker, every single user account on the PC will have its files encrypted. BitLocker uses the computer’s trusted platform module — or TPM — hardware.

 

While “drive encryption” is more limited on Windows 10 and 8.1, it works similarly on PCs where it’s available. It encrypts the entire drive rather than individual files on it.

 

EFS Encrypts Individual Files

EFS — the “encrypting file system” — works differently. Rather than encrypting your entire drive, you use EFS to encrypt individual files and directories, one by one. Where BitLocker is a “set it and forget it” system, EFS requires you manually select the files you want to encrypt and change this setting.

 

You do this from the File Explorer window. Select a folder or individual files, open the Properties window, click the “Advanced” button under Attributes, and activate the “Encrypt contents to secure data” option.

 

This encryption is on a per-user basis. Encrypted files can only be accessed by the particular user account that encrypted them. The encryption is transparent. If the user account that encrypted the files is logged in, they’ll be able to access the files without any additional authentication. If another user account is logged in, the files won’t be accessible.

 

The encryption key is stored in the operating system itself rather than using a computer’s TPM hardware, and it’s possible an attacker could extract it. There’s no full-drive encryption protecting those particular system files unless you also enable BitLocker.

 

It’s also possible that the encrypted files could “leak” out into unencrypted areas. For example, if a program creates a temporary cache file after opening an EFS-encrypted document with sensitive financial information, that cache file and its sensitive data will be stored unencrypted in a different folder.

 

Where BitLocker is essentially a Windows feature that can encrypt an entire drive, EFS takes advantage of features in the NTFS file system itself.

 

Why You Should Use BitLocker, and Not EFS

It’s actually possible to use both BitLocker and EFS at once, as they’re different layers of encryption. You could encrypt your entire drive, and, even after doing so, Windows users will be able to activate the “Encrypt” attribute for files and folders. However, there’s not actually much reason to do so.

 

If you want encryption, it’s best to go for full-disk encryption in the form of BitLocker. Not only is this a “set it and forget it” solution you can enable once and forget about, it’s also more secure.

 

We’ve tended to gloss over EFS when writing about encryption on Windows and often only mention BitLocker as Microsoft’s solution for encryption on Windows. There’s a reason for this. BitLocker’s full-disk encryption is just superior to EFS, and you should be using BitLocker if you need encryption.

 

So why does EFS even exist? One reason is that it’s an older feature of Windows. BitLocker was introduced along with Windows Vista. EFS was introduced back in Windows 2000.

 

At one point, BitLocker might have slowed down overall operating system performance, while EFS would have been a bit more lightweight. But, with reasonably modern hardware, this shouldn’t be the case at all.

 

Just use BitLocker and forget Windows even offers EFS. It’s less of a hassle to actually use and is more secure.

 

Credit to

[vibranium]

Excellent advice.

 

One scenario to consider EFS (which can be used in tandem with Bitlocker) :  multiple users on the same computer.

[oliverjia]

The use of EFS is dangerous, and has caused data loss in many cases, as people tends to forgot to save the certificate. So one day they re-installed Windows, and they found suddenly they lost access to the EFS folder because EFS is tied to the original user account. As they did not save the certificate, which is required to gain access to the EFS folder, they permanently lost access to their data forever. 

So EFS is too dangerous to use. If you want to encrypt your individual files, use AxCrypt, or even 7-zip/WinRAR and the like, but not EFS.

[vibranium]

It would be dangerous if the files were recoverable after that!

 

If EFS is dangerous, Bitlocker is also dangerous, very dangerous.

[jamesDDI]

4 hours ago, oliverjia said:

The use of EFS is dangerous, and has caused data loss in many cases, as people tends to forgot to save the certificate. So one day they re-installed Windows, and they found suddenly they lost access to the EFS folder because EFS is tied to the original user account. As they did not save the certificate, which is required to gain access to the EFS folder, they permanently lost access to their data forever. 

So EFS is too dangerous to use. If you want to encrypt your individual files, use AxCrypt, or even 7-zip/WinRAR and the like, but not EFS.

 

About AxCrypt bad is that new version 2.0 has the 256 bit encryption in the paid variant