Re: BugTraq: EFS Win 2000 flaw

[John Wiltshire <jw () QITS NET AU>]

"Inside Windows 2000 - 3rd edition" (MS Press) has a description on how
the EFS system works, including the creation of the temporary file
described here.

It appears that the temp file is created to allow rollback on system
failure during encryption.  This, however, does not excuse the failure
to erase the disk space used by that file once the encrypted file has
been written to disk.  This may lead to a small window where the disk is
in a consistent state (ie the file has been successfully encrypted) and
the backup data is yet to be erased, so the logging/recovery process
should be modified in any fix to ensure that the file system recovers
system failures in the best way possible - obviously a failure during
encryption will leave the unencrypted file on disk for recovery, but a
successful encryption should always remove the unencrypted data.

John Wiltshire