SafeGuard Volume based and File Based Encryption

Question

I'm deploying SafeGuard Enterprise Encryption for a customer. The goal is that all data on the computers hard disk should be always automatically encrypted and can not be read if copied outside of the managed SGN clients computers.

First I thought about using Volume Based full disk encryption for internal storage (boot and non-boot volumes). I made the policy and applied it to the target computers and all the volumes got encrypted but I found out that the files are not encrypted as if I shared a file from an encrypted volume (through mail for example) the recipient can read file without needing the SGN client and the encryption key. So from my understanding, and correct me if I'm wrong, Volume Based full disk encryption makes the volume not readable if connected to a computer without SGN client and the key but the files are not encrypted.

So I tried using File Based full disk encryption which achieves what the customer needs. The files are encrypted on the hard disk and if the file is shared the recipient will not be able to read the file if he doesn't have the SGN client and the key but I can not encrypt boot volumes using file based which the user can use this limitation to share unencrypted files by opening the encrypted file from the file based encrypted volume then use "save as" from the application to the boot volume and create unencrypted copy of the file to share it.

Kindly advise about the setup required to achieve the customer's goal

This thread was automatically locked due to age.

FormerMember · Answer

Hello Ahmed, 
 This behaviour is expected, unfortunately there's no way to change it - the idea is to keep all local data secure without the need to decrypt when sending files elsewhere. The alternative would be that every time you uploaded a file from your PC, emailed something to someone outside your organisation etc you would need to manually decrypt each and every file which just isn't practical. 
 Naturally the only time a file is being taken outside the organisation is when an internal member of staff chooses to do so, if someone were to come into the building and steal one of these hard drives they would see the data as encrypted. 
 If you need to take files outside the organisation and keep them encrypted then you can use the Data Exchange feature to copy the files elsewhere via Cloud-based services like DropBox, or copy the files onto a Pen Drive. The files can then be decrypted at your destination with a passphrase, or if you're going to another of your offices protected by the same SafeGuard setup you'll be able to access the data as if it wasn't encrypted..