43

I somehow encrypted some files without meaning to, and because of it I can't backup my user folder to Mozy. Is there a way to remove the encryption from all the files or at least find out which one are encrypted?

I'm runnin windows 7 ultimate 64bits

8 Answers 8

48

This may be an older question; but I recently had the same need.

My goal was to be comprehensive (search all files) and not require additional software, so it uses the command prompt and any text editor.

Here is what I found as a workable solution:

  • open a cmd prompt
  • Enter the command: cipher /s:c:\ > encryption.txt
  • Open the file "encryption.txt"
    • To find encrypted folders, search for "will be encrypted"
    • To find encrypted files, search for "E" at the beginning of a line

Without parameters, Cipher lists state of the current directory and all files in it. The /s parameter tells it to recurse, and c:\ gives it the starting point. From there, "> ..." just redirects the output.

Cipher's output for encrypted files and folders look like this:

 Listing c:\Dev\Encrypted\
 New files added to this directory will be encrypted.

E Default.aspx
E Default.aspx.cs
E Default.aspx.designer.cs

Cipher's output for normal files and folders look like this:

 Listing c:\Dev\Plaintext\
 New files added to this directory will not be encrypted.

U Default.aspx
U Default.aspx.cs
U Default.aspx.designer.cs

Hope that helps.

5
  • +1 great answer - easily repeatable (CLI), no need to download any 3rd party apps and a persistent, searchable output
    – AdamRalph
    Mar 13, 2011 at 17:05
  • 1
    Just tried this on Windows XP Pro, worked a treat, thanks. I used cipher /s:c:\ | find "E " not perfect, but worked for my use. Nov 9, 2011 at 2:21
  • 14
    You can use cipher /u /n to list all encrypted files, on all drives.
    – mivk
    Jan 18, 2013 at 14:50
  • 3
    Based on trying @ChristopherGalpin 's version of this answer (thanks!), I can suggest this one: cipher /S:. | findstr /b /c:"E" /c:" " > encryptedFiles.txt as slightly more accurate - it won't catch unencrypted files with names like E Marketing strategy, I wanted to see what directory they were in also - to make for easy removal - so it also includes the directory names - however it will include directories without encrypted files, so there is a little cruft still in the output. Mar 28, 2013 at 6:08
  • 1
    After you ran cipher /s:c:\ > encryption.txt the first time, you can run it again and search through other disk volumes, like D, E and F. Just replace the drive letter with whatever additional drive letters you have, issuing the command each time. Instead of overwriting the content of the TXT file, you can append it, like so: cipher /s:d:\ >> encryption.txt Then you can open it in Notepad++ (or other editor with regex) and find lines beginning with E by using the basic pattern ^E.
    – Samir
    Nov 2, 2014 at 0:22
18

cipher /u /n /h will find and list all encrypted files on your hard drives (as mivk commented on the other answer) without need for any additional filtering (that could go wrong). Credits for this also go to this tutorial where I found this answer.

Note: If there are no encrypted files on the system (any disk), the command returns immediatelly with the response:

The system cannot find the file specified.

This is not an error. It means there are no encrypted files. It seems in this case this info is cached somehow.

Important note: This does not list all encrypted files! Apparently it only lists files belonging to the current user who is running the command.

As for unencrypting the files, Snark has already answered that part. It can also be done by command line, again with the same tool: cipher /D ...

See the help for additional info and other uses: cipher /?

13

With Total Commander, you can do a search (ALT+F7) on various attributes of files and folders.

The "encrypted" attribute is one of them.

alt text

Once you have found all encrypted files and folders, select "Feed to listbox". It will put all names in the selected pane (left or right). There, you can select them all, right-click and select Properties. You'll get the Properties window for all the selected files. In the Advanced window, you can easily decrypt them by unchecking the "Encrypt..." checkbox.

alt text

1
11

You can type: encryptionstatus:encrypted Into the search field in an explorer window.

7
  • This might not the answer, I try to create an encrypted file. I dont know why in my Win7 the Encryption Status column does not show any value and so encryptionstatus:encrypted also simply shows nothing. answer from @Robert is the right way. found this file have 'E' at the begining of line.
    – CallMeLaNN
    Jun 13, 2011 at 5:22
  • 1
    Just typing in encryptionstatus: into the search field shows a dropdown, completion menu with the entries "Encrypted" and "Unencrypted" that you can click on. So this is correct syntax, encryptionstatus:encrypted and encryptionstatus:unencrypted and it's built right into the search in Windows (File) Explorer.
    – Samir
    Nov 2, 2014 at 13:15
  • I can't say if it works for sure on encrypted files. But I don't see why it shouldn't. I have tested this in Windows 8.1 Pro with Update 1. Using encryptionstatus:unencrypted did list pretty much all my files. But encryptionstatus:encrypted is still in progress. Probably because I don't have any encrypted files. Not that I'm aware of anyway.
    – Samir
    Nov 2, 2014 at 13:15
  • @CallMeLaNN If the column is empty then it probably means the given files are unencrypted. Does it say "encrypted" for files you have in fact encrypted?
    – Samir
    Nov 2, 2014 at 13:18
  • On my work computer, even EFS encrypted ("green-marked") files have an empty "Encryption status" column - therefore, this does not work for me :-( Mar 28, 2015 at 18:56
6

You can use Windows Search Advanced Query. In search bar type: * is:encrypted. This command will find all encrypted files in folder.

2
  • 1
    Did not work for me (shows no files) even though the cipher command line tool does show encrypted files (which are marked in green within Windows explorer) Mar 28, 2015 at 18:59
  • 1
    Will this show hidden files too? As I have a ton of encrypted files, but all of them are hidden, when I run this query, none is showing up.
    – RogUE
    Aug 23, 2015 at 13:58
6

After trying Total Commander and having it fail for some inexplicable reason, I tried NirSoft's SearchMyFiles and it worked excellently. Lightweight standalone executable and the results don't have cruft to wade through like the cipher command; you can easily sort by folder path to know what listings are merely subdirectories of a parent encrypted folder.

SearchMyFiles

SearchMyFiles Search Options

1
0

I used cipher /s:f:\ /d > encryptionFIX.txt

Yes it was cipher a different drive letter "f"

It tries to remove encryption, any errors will be listed in the cmd prompt. Plus you can review the document for the errors.

This came in handy for me as I was cleaning up a external hdd and came across 150 files that where encrypted. So I wanted to know what and where they were as I do not use a encryption on my computers. Turns out it was from a few downloads that I can easily get. Or seeing "_MACOSX" folders on my pc. They are always encrypted.

1
  • related- superuser.com/questions/1603918/… Looks like Windows's native unzip when it reads the zip header of a zip file messes up the attributes of the files, when the zip file comes from OSX.
    – barlop
    Nov 21, 2020 at 21:26
0

For the only truly INSTANT local result:

Install Everything from voidtools. Change 1 setting to include attribute INDEXING (you do NOT need to enable quick sort to take on that overhead). This way, it is simply the attribute storage you add.

TO USE: Type this in the search bar: attrib:E and don't even need to press enter. Every EFS encrypted file ON THE ENTIRE SYSTEM ALL DRIVES is returned INSTANTLY.

Because it is indexing off the USN (and always up to date), and can even index remote folders - I have not yet found another method faster and more reliable (once it's original index is built which on most modern systems takes seconds).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .