Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ok this is kind of an odd question:

What do Windows 7 (Home Premium) encrypted files (EFS) look like "from the outside"?

Now here is the story. An acquaintance of a freind of mine got a nasty virus / scareware. So I whipped out my PC technician cap and went to work on it. What I did was remove the drive from the laptop and put the drive into my external drive bay. I scanned the drive and yes it was loaded with stuff. That basically cured the infection and I could start the system back up.

To check if it cured the problem I wanted to see the system while running. There where two user accounts, on with a password and one without (both admin users !?!). So I logged into the unprotected user and cleaned up the residual issues, like proxy server to localhost in the browser config. Now I wanted to do the same for the password protected user.

What I noticed that from my system and the unprotected user account the files of the protected user looked garbled. The files are something like 12 random alphanum chars, but the folders looked ok. Naive as was thought this might be how encrypted files looked "from the outside". (I never use Microsoft's own security features, so how would I know. TrueCrypt is one big blob.)

Since the second user could not be reached, I though sod it and removed the password from the account. (That might have been a mistake, I know.) Now I did the same clean up tasks and all nice and fine; except for the files which where still "encrypted".

So I looked into many Windows Encrypted Files recovery posts and not all hope is lost, since I should be able to extract the certificate and with the password regain access to the files. Also note that windows did "only" prompt me that removing the password would be insecure, not that access to encrypted files would be lost, like it is claimed in most recovery articles. Resetting the password did not help and I gave up for the night.

The question that nagged me half of the last night was, what if the files are not encrypted, but the scare-ware encrypted / destroyed the files? I don't want to spend hours of work trying to recover files that are not recoverable. The ting is that the user does not remember turning it on and aren't the files marked in blue and the filename is readable?

Many thanks for input from users who have more knowledge about Windows EFS...

share|improve this question
There is no "Home pro" version of Windows 7. You can have "Windows 7 Home Premium" or "Windows 7 Professional". Which one do you have? – Robert Oct 9 '12 at 7:55
Home Premium, I will edit this in the text. – Sean Farrell Oct 9 '12 at 8:52
AFAIK Home Premium only supports EFS via command line tool and no Bitlocker. Are you sure you are using the Windows integrated encryption? – Robert Oct 9 '12 at 8:56
As I wrote, I am more and more thinking that the virus killed the files. THAT is why I am asking about how encrypted files "look like" when viewing them without credentials. – Sean Farrell Oct 9 '12 at 9:50
Encrypted files do not have a specific format - they look just like random data. And if you have credentials or not doesn't matter as encrypted files are not automatically decrypted. If you have a trojan you should delete the HDD, re-install the system and restore your files from backup. – Robert Oct 9 '12 at 9:54
up vote 1 down vote accepted

Ok it took some research and some trying out. But I found the answer to my question:

Files that are encrypted with Windows EFS are green and the filename 
is unaltered. This is true when authenticated or not.

Pity for the user who lost his files, not backup there.

share|improve this answer

Encrypted files look like random data with high entropy. If they looked like something, you would know they are encrypted, with which algorithm and even which data was encrypted, which will defeat the very purpose of encryption.

share|improve this answer
I know about data, but in the special case of Window EFS the file system knows what files are encrypted. They are green and definitely not garbled. – Sean Farrell Oct 10 '12 at 15:26

This is an ancient question but I think this is worth adding:

Yes, in Explorer, they look green (assuming you have enabled "show encrypted and compressed files in alternate color") and the file names are not garbled. (So be aware that the file names themselves may leak information.)

If you try to open one without access to the EFS certificate that protects the session key (basically, if you're not logged in as the user who encrypted the file), you will not see encrypted contents. Your open attempt will simply fail, just as if you had been denied access to the file via its ACL. (This is pretty easy to test if you can create a second account on your machine.)

If you do have access to the EFS cert, then the file just acts like a normal file. You do not perform a separate "decryption" step to use the file.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .