How to prevent data loss on encrypted storage cards that are used in Windows Mobile devices

On a Microsoft Windows Mobile 6-based device, you can help protect sensitive data on the storage card by using encryption. This article describes how to access encrypted data. The article also describes how to prevent data loss after you use encryption to help protect data on a Microsoft Windows Mobile 6.0-based device.

You cannot encrypt all the data on a storage card. You can encrypt the following kinds of data:

• Data that is written from the mobile device to the storage card.
• Data that is transferred to the storage card by using Microsoft ActiveSync or Windows Mobile Device Center.

However, you cannot encrypt nonencrypted data that is transferred to the storage card from another device. For example, you cannot encrypt nonencrypted data that is transferred to the storage card from another mobile device or from another computer.

Encrypted data can only be used on the mobile device that encrypts the data. You can access the encrypted data by using one of the following methods:

• Use the mobile device.
• Use the file explorer that Active Sync provides.
• Browse the device from Windows Mobile Device Center. Windows Mobile Device Center is included with Windows Vista.

You can manage storage card encryption by using Exchange Server 2007 policies. You can also manage the mobile encryption configuration by using Control Panel.

If you must hard reset the mobile device or run the Clear Storage application, make sure that you back up the data on the storage card. You can use one of the following methods to back up the data:

• Use the file explorer that Active Sync provides.
• Browse the mobile device by using Windows Mobile Device Center, and then copy the data to the computer.

The key that is used to encrypt the data on the storage card is kept on the device. When a hard reset is performed or when you run the Clear Storage application, the key is lost. Therefore, you cannot read the encrypted data.

When you perform a ROM update of the mobile device, you may be prompted to perform a hard reset. Therefore, back up the encrypted files before you perform a ROM update.

If you copy files from the device to a computer by using ActiveSync or Windows Mobile Device Center, the files are always decrypted regardless of the status of the Encrypt files placed on storage cards check box. This check box only indicates whether new files that the mobile device writes will be encrypted. If you remove the storage card from the mobile device and then you connect the storage card to a computer or to another device, you cannot read the files. Windows Mobile does not decrypt the encrypted files on a storage card even if the Encrypt files placed on storage cards check box is cleared.