Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Since a few days when I start Windows Vista i get a Popup from "Encrypting File System" (coming from process efsui.exe) asking me to backup the certificate and key.

I don't know what i did to get this message (The last SW i did install was google desktop).

Now i'm wondering what directories or file are encrypted with EFS. Is there a way to found out?

Thanks for your help.

share|improve this question
up vote 8 down vote accepted

You can trying using this batch file :

@echo off

:: Set the varibles - Use Quotes "" if there are spaces in the source or log path
set log_path=C:\EFS_Find

:: Find Encrypted Files
cipher /s C:\ | findstr "^.E" >> %log_path%\found.txt && echo:Encrypted files found"

:: Find Hidden Files
attrib /s C:\ 2>nul | findstr "^....H" >> %log_path%\found.txt && echo:Hidden files found"  


This batch file will scan your C:\ drive for all EFS encrypted files (and also hidden files), echo on the screen every time it finds one, and record all instances of encrypted files found into C:\EFS_Find\found.txt.

For a command-line approach to finding just encrypted files, you can type in the command-line :

cipher /s:C:\ | findstr "^.E" >> C:\efs_found.txt && echo:Encrypted files found"

This will search your entire C:\ drive for encrypted files, and dump it into C:\efs_found.txt.

Modified from the solution found here.

To disable EFS on your Vista system, I refer you to the link here :

How to Disable or Enabled EFS Encryption in Vista

share|improve this answer
thanks you. just for the records its cipher /s:C:\ – gsharp Sep 10 '09 at 7:46
Oh alright, thanks!! – caliban Sep 10 '09 at 10:28
The command listed here is incorrect (at least in win7). It should be: >cipher /s:C:\ /h | findstr "^.E" >> C:\efs_found.txt && echo:"Encrypted files found" Notice the colon after the /s. – user146125 Jul 15 '12 at 12:04

gsharp is correct, the syntax to display all EFS encrypted files on drive C: is

cipher /s:c:\ |findstr "^E"

Pay attention to the pipe character, which is usually found on the \ key. The findstr command ^E looks for the E at the beginning of the line. Also pay attention that the /s has a colon after it and the drive letter, all with no spaces.

The downside is only the filenames are returned, there is no directory structure provided.

share|improve this answer

For Win7 users: I just had the same problem, (someone sent me a zip file prepared on a mac, that for some reason encrypted itself on decompression), and I started to get the EFS Key backup prompt.

cipher /s:c:\ |findstr "^E"

and its variants returned no information.

however I was able to find the encrypted directories with:

cipher /u
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.