Inadvertent Decryption
More devilish details concern copying, editing, backing up, and recovering encrypted files: Can any of those actions inadvertently decrypt a file? And does encryption interfere with backing up a file?
Before I go further, let me say that encrypting entire folders, rather than particular files, is a good idea, particularly if you're encrypting files that you've used simple applications to produce. Many simple text editors, word processors, and spreadsheets never actually "save as" when you tell them to Save As. For example, in many editors, if you edit a file named stuff.txt and tell the editor to save the file, the editor takes several steps. First, the editor renames the old stuff.txt file—for example, to stuff.$$$. Then, the editor saves the revised stuff.txt to disk as a new file. Finally, the editor deletes the renamed file, stuff.$$$, or changes its extension (e.g., to .bak). Thus, if a problem occurs in the middle of saving the file, the editor can retrieve the original file (i.e., stuff.$$$).
This multistep approach to saving files is good belt-and-suspenders programming. But if you encrypt stuff.txt, then later edit it and save changes, the editor eliminates the original stuff.txt, so EFS figures that its job is done and doesn't encrypt the revised stuff.txt file. Not all applications exhibit this behavior, but many do. When you encrypt the entire folder rather than only the file, EFS encrypts everything you store in the folder and your files remain encrypted no matter how your application saves them.
If you copy an encrypted file to another NTFS5 volume, NTFS5 encrypts the copy as well, even if the volume is across the network. Of course, if you copy the file to a floppy disk, a FAT drive, or some other non-NTFS5 drive, the copy isn't encrypted. (However, only you can copy a file you've encrypted, so another user can't decrypt your file by copying and then reading the decrypted copy.) If you're using Offline Files on your workstation and you cache an encrypted file, the copy in your local cache isn't encrypted. (Offline Files warns you before it caches an encrypted file.) I haven't figured out a way to encrypt \winnt\csc, so you might want to make an administrative decision to disallow caching on shares that contain encrypted data.
Assuming that you're an administrator (and so have backup and restore rights), you can back up and restore encrypted files. The backup or restore routine simply copies the encrypted bits to or from the backup medium.
Beyond the Basics
This information will start you off learning your way around the basics of administering systems with EFS, but you still have lots more to learn. (See "Related Articles in Previous Issues" for more EFS-related information.) Do yourself a favor and try a bit of encryption, backup, restoration, and recovery on a file or two now, before a user presents you with an encryption-related problem.