Hi everyone: I have a laptop that I keep my customer data in - nothing extraordinary like bank accounts, credit cards, etc. - just people's names, addresses and such. All the data is located in My Documents folder in a custom software that does not have any good password protection. I set up a user account in Windows XP that is required to log in to my laptop. Moreover the My Documents folder for that user account is set to private and the laptop's screen saver that kicks in every 5 minutes is password protected. The password for the Windows XP user account is a 6-character combination, that is not a word in a dictionary. I'm just curious, say if someone was to steal my laptop, how easy would it be for a hacker to break into my customer data with all the security measures I have? And, if what I have is not enough, how would you recommend to better protect my data? Thank you in advance!

You could encrypt the data. I hope you keep a backup of that data on CDR safely tucked away.

If I stole your computer and wanted to get past a password authentication issue it wouldn't be very challenging. There are plenty of tools that allow you to change user passwords (my favorite is Winternal ERD (a bootable CD that has tons of little utilities on it, mainly the Locksmith program that allows you to reset administrator/user passwords)). If I didn't have that laying around I would just plop in a CD and do a parallel install of Windows on the drive and get to your information that way. You should really look into some 3rd party encryption/security software if you have sensitive information on your hard drive. Holy Wow.

Thank you for your quick responses. I do keep a back-up of my data, but again the software I use does not have any substantial means to protect the data, thus it sounds like what I will have to use is some third party (and hopefully Microsoft-provided) means to encrypt it. Honestly, I was under impression that the user password in Windows XP was a good security measure until recently someone told me otherwise. That is basically why I'm asking it here. OK. I did some exploring and found out that if I right click on My Documents folder and then go to Properties and then click Advanced, there's a check box that says, "Encrypt contents to secure data". It is not checked now. I'm curious if I check it, will it help better secure my data? I'm also concerned whether it will significantly slow down my computer or not? Thanks again.

If you lose the password to unlock the data there is no way to recover it. Another issue is if your computer hardware fails and the drive needs to be transferred to another computer you may not be able to access those encrypted files. That is why it is imperative you back them up elsewhere. I would recommend for those reasons that you NOT encrypt the entire My Documents folder unless all files in there are sensitive. Create a subfolder for any files requiring encryption and apply only to that folder.

I agree with OtheHill that a encrypted folder would be a good solution with a strong password. You would need XP PRO as xp home doesnt't include encrypted folders. There are third party applications that may suite your needs also. The user logon is useless to any hacker with physical access. You may be also subject to privacy laws. You may be required to protect the privacy of users. Even with encrypted folders you may be allowing access to your computer. Only a group of best practices can prevent data loss. My guess is you run your laptop with an Admin account and have the entire drive shared. "Best Practices", Event viewer, host file, perfmon, antivirus, anti-spyware, Live CD's, backups, are in my top 10

Sure, I'll follow this advice. But I have a couple of questions. OtheHill, when you say, "if your computer hardware fails and the drive needs to be transferred to another computer you may not be able to access those encrypted files" - does it mean the data will be lost even if I remember the encryption password? Also, jefro, what do you mean by "strong password"? As for the privacy laws, I know that. I thought my current set-up with the Windows password was complying with it. And, yes, I do run Windows XP with an administrative account that is protected under password. All of my data is located in My Documents folder that is set to "private". So to answer your question, then no, I do not have my whole drive shared.