In the real world this is a feature implemented for directories containing operating systems, or part of some programs. To exclude a directory from encryption is the sole privilege of Administrator. When a secret key is regenerated, newly saved files are encrypted with the new key, but original encrypted files are decrypted with the old one. It is possible to re-encrypt old files with the new key, in which case files are firstly decrypted with the old key, and only then in their plain form encrypted with the new one. This can be done only by the user, who has access to this new key.
Encryption is done with the personal secret key of the PC user.
In case it is too difficult to divide the disk onto two logical segments and move data onto the second one, another strategy can be applied. Subsequently all other directories on the disk are encrypted with the personal secret key of the user. The encryption of removable media can be set in a similar way as the encryption of whole disks. After the insertion of the removable disk into a drive its root directory is defined as encrypted. Once this is done, all files and directories saved onto the medium will be automatically encrypted with the appropriate key.