312-49 · Question #392
An employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the employee computer that was protected with…
The correct answer is C. When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you. NTFS EFS (Encrypting File System) encryption exists exclusively on NTFS-formatted volumes. Floppy disks are formatted with FAT, which has no concept of EFS and cannot store encryption metadata or keys. When Windows copies an EFS-encrypted file from an NTFS drive to a FAT…
Question
An employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the employee computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to astored on the employee? computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the employee before he leaves the building and recover the floppy disk and secure his computer. Will you be able to break the encryption so that you can verify that the employee was in possession of the proprietary information?
Options
- AEFS uses a 128-bit key that cannot be cracked, so you will not be able to recover the information
- BThe EFS Revoked Key Agent can be used on the computer to recover the information
- CWhen the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you
- DWhen the encrypted file was copied to the floppy disk, the EFS private key was also copied to the
How the community answered
(48 responses)- A8% (4)
- B2% (1)
- C83% (40)
- D6% (3)
Explanation
NTFS EFS (Encrypting File System) encryption exists exclusively on NTFS-formatted volumes. Floppy disks are formatted with FAT, which has no concept of EFS and cannot store encryption metadata or keys. When Windows copies an EFS-encrypted file from an NTFS drive to a FAT destination, it must transparently decrypt the file during the copy process because the target filesystem cannot maintain the encryption. The resulting file on the floppy disk is stored in plaintext and is fully readable without needing to crack any key.
Topics
Community Discussion
No community discussion yet for this question.