Well, do you know how to recover data with encrypted with EFS if your OS crashes? That's important if you're going to use EFS. Also, it's not clear whether you did this so you could encrypt your wallet file or to free up space on your main drive. That having been said...
If it was for encryption:
I'm pretty sure EFS can do individual files, so splitting up the directory is unnecessary
If it was to free up space:
You can move the entire Bitcoin directory and get rid of the other extra steps if you add (to match your example) "-datadir=X:\Bitcoin" to your bitcoin-qt or bitcoind command.
It might still be useful to split up the directory if you want the blockchain data on a non-redundant drive and the wallet on a redundant array, but even a redundant array can be lost, and you should be making backups of your wallet, so if you wanted redundancy, I'd think it would be more useful for the blockchain data that you aren't backing.
Yes, EFS recovery is kinda simple, if not well publicized. When you use EFS, there are public / private keys uses just like bitcoin. If you know where to look, you can export these keys from the system hosting the EFS files and store then on the system you want to access them from. This is the data recovery methodology.
The reason EFS is of interest to me is because of a recent "I lost my bitcoins" thread. The victim in this case had a very strong RPC password that he mistakenly shared with his hot wallet. The attacker gained access to the SYSTEM account (like root in windows) which generally has access to all files. With the heightened access level they were able to read the RPC password and tried it on the wallet which succeeded in compromising the account.
Now there are two ways to prevent system from reading your files:
1) you remove SYSTEM from the access control list of the file in question (can cause some odd problems)
2) you employ EFS on the file in question.
With the second option, SYSTEM can read / write / delete the file, but can't decrypt. This allows it to do basic system maintenance (defrag, etc) without breaching security.
so much psudo-security advice here.
If someone has SYSTEM access, you're already pwned. They can easily modify critical system files (like filesystem drivers) to allow intercepting wallet.dat while it's decrypted. Or they can modify explorer.exe so it decrypts all files belonging to the current user. Or my favorite, install a patched version of bitcoin that always sends its bitcoins to the attacker's address.
Also, SYSTEM can also take ownership of any object. So even if you removed SYSTEM from the ACL, it can easily set itself as owner and add itself to the ACL.
Show Posts
