Backing up your certificates and keys to removable media presents its own share of concerns, however-anyone getting his or her hands on the backup media now has your encryption information. But you can leverage the process to block online intruders from gaining access. To do so, delete the certificate and key from
your hard drive and let them live solely on the removable media. Of course, if your encrypted data is on a laptop, you'll need to be sure to take the removable media with you in order to access it, but you'll feel better knowing that the data will be safe even if someone steals your laptop and your account password.

After exporting the certificate, browse your removable media to make sure the file is actually on it, then remove the media from the computer. Open the Certificate Manager (click the Start button and type certmgr. msc in the Search box at the bottom). In the left-hand pane, expand the Personal entry and click Certificates so that you see your username at the right (this is where the certificate you created is located). Right-click your username and choose Delete. Don't worry, you still have the certificate on your removable media.



Now, use Windows Explorer to browse to your encrypted folder. Vista displays the folder and its files in green. If you try to open one of the files, you'll see an information dialog telling you that you do not have permission to do so. This warning means that your PC does not contain a certificate that corresponds to your user account for decrypting files. You'll need to restore to your system the certificate you exported to the removable media.

To do so, connect the removable media to your PC, open the Certificate Manager, and right-click the Personal item in the left-hand pane. Choose All Tasks I Import to load the Certificate Import Wizard. Click Next and browse to the file on your media (the resulting dialog defaults to CER and CRT file types, so click the "file types" arrow and choose PFX files). Choose your exported file and click Open. Click Next, enter the password you assigned to the file, and click Next again. On the Certificate Store screen, stick with the default selection to place the certificate back in your personal account area. Click Next and then Finish. Go back to Windows Explorer and open your data file.

By going through the encryption process, combined with the process to delete and restore certificates, you can keep your private data files private. But be sure to back up the certificate to two or three separate media to make sure you have access if one of the media devices fails, as hardware sometimes does.