Why are files from macs often encrypted when put on an external drive and that drive is plugged into a windows system?

I'll explain what I mean 'cos they don't look encrypted at first sight, as you can open them..

but on closer inspection, they can show up green in windows explorer

enter image description here

and the windows cipher command shows then as encrypted, and their attribute properties show as encrypted.

enter image description here

I'm not the only person that has run into this, looking for example How to list encrypted files in Windows 7? one poster writes "... I was cleaning up a external hdd and came across 150 files that where encrypted. So I wanted to know what and where they were as I do not use a encryption on my computers. Turns out it was from a few downloads that I can easily get. Or seeing "_MACOSX" folders on my pc. They are always encrypted."

An example I ran into is a program I wrote in rails just a directory called "scaffoldingtest1" that I created with the command rails new scaffoldingtest1 and i'd have copied a parent directory to an external hard drive.

I've also seen some PDFs related to adobe, from Mac users.

And they're encrypted as if they were encrypted on the windows machine, in that they can only be viewed from that windows username @ that computer. As shown in the properties of the encryption in windows. And that user at that computer can decrypt them. But they somehow got encrypted like that. If that external drive were taken to another windows computer, then they can't be read.

And i'm wondering what setting on OSX is causing that?

Note- since some moderators have a tendency to delete long comment threads and lose important info, here is a link to the comment thread at the moment backed up here as of 21/11/2020 20:13 UK time https://pastebin.com/raw/f2Aytv6W

  • 1
    What are you using to determine if a file is encrypted or not? Can you add an example to your question? It sounds like what you're seeing is the result of user permissions, which if that is the case is not the same as encryption.
    – Scottmeup
    Nov 21, 2020 at 8:22
  • 2
    We still don't know how you are identifying these files as encrypted. Usually on Windows files with names in green are compressed. Get Properties on the drive in question & see if it's set to compress
    – Tetsujin
    Nov 21, 2020 at 8:29
  • 1
    What's crucial here is the difference between "Windows Tools think a file is encrypted" and "A file is actually encrypted". The file is not encrypted on the Mac side of things, it also isn't encrypted on Windows (otherwise you wouldn't be able to read it) so it must be something in its metadata which makes Windows Explorer think it is.
    – nohillside
    Nov 21, 2020 at 14:36
  • 1
    @nohillside You're right it's cross-OS, and I perhaps formulated myself too harshly there. I just meant that it didn't need to move off AD because it is also Mac-related... but it fits in on SU as well :-)
    – jksoegaard
    Nov 22, 2020 at 8:28
  • 1
    Just to clear up any confusion... this issue is really about a bug in the Windows unzipping utility. There's no doubt it is a Windows bug. However, Windows users are only going to come across this bug when they interact with users on other platforms, so for user's it is natural to assume that the bug is on the other platform.
    – jksoegaard
    Nov 22, 2020 at 8:30

1 Answer 1


The reason for this is a known compatibility issue with the built-in macOS Archive program and the built-in unzipper in various Windows versions.

When you use the "Compress" tool built-in to Finder, you'll get a ZIP-file. The ZIP-file contains, amongst other things, what is known as "external file attributes" for each file. These attributes are host-system dependent (i.e. these attributes are not guaranted to be understood the same way on various operating systems).

Unfortunately, one of the attributes that the macOS tools marks the files with are interpreted by the Windows built-in unzip tool as marking the file as "encrypted" (which is a special form of single-file encryption built-in to the NTFS file system). This means that when unzipped the files have the encrypted attribute and their names are shown in green in the Windows Explorer.

However, there are no significant downsides to this as you can easily open Properties on the files and remove the checkmark on the "encrypted" attribute. The file contents is not really encrypted, so the files can be opened as always.

You can avoid this issue by either using a different compression tool on the Mac, or by using a different decompression tool on Windows.

The technical details are as follows:

The problem is caused by the Windows unzipper incorrectly parsing the "external file attributes" in the ZIP-header for each file/folder. This element of the header is host-dependent, as such the unzipper should check the element of the centrall directory file header known as "Version made by" to inspect which operating system made the file. The macOS compression tool correctly stores the attribute value 3 for "Unix" here.

Unfortunately the Windows tool disregards this value and always interprets the file attributes as though they were created on Windows. The "encryption" issue comes from the fact that ZIP-files created on Windows stores file attributes according to the file attribute constants (FILE_ATTRIBUTE_<...>) defined by Microsoft. In particular FILE_ATTRIBUTE_ENCRYPTED defined by the value 0x4000 means encrypted file or directory. However Unix-systems use the POSIX constants where S_IFDIR is the attribute that means "this is a folder" - and is typically defined as the value 0040000, which is equivalent to 0x4000.

  • I used to use a laptop a lot, username harvey, computer name samsung. And I had an external hard drive connected to that..It had some files from mac users/ mac laptops. When I moved that external hard drive to another computer user@probook (that's a windows laptop) , I could not open those files. They showed as encrypted by harvey@samsung (that's a windows laptop). I had to decrypt them on my old harvey@samsung laptop. I was not able to untick the encrypted option otherwise. And cipher wasn't able to "decrypt" it except from the samsung350 laptop (which the file did show as being from).
    – barlop
    Nov 21, 2020 at 19:29
  • You mention " there are no significant downsides to this as you can easily open Properties on the files and remove the checkmark on the "encrypted" attribute." <-- Though see my comment above
    – barlop
    Nov 21, 2020 at 19:32
  • So, I couldn't read it from a newer laptop that I plugged the hard drive into, unless I ran cipher /d on the file, from the machine that windows showed in its encryption properties
    – barlop
    Nov 21, 2020 at 19:37
  • btw, interesting, I see superuser.com/questions/120354/… there's "file security status" (encrypted / not encrypted), and "file system or OS of origin" e.g. UNIX so I guess I can see how that could go wrong
    – barlop
    Nov 21, 2020 at 21:29
  • 1
    @barlop I'm a programmer and have work with ZIP-files many times. The constant FILE_ATTRIBUTE_ENCRYPTED is not part of the ZIP-header, so you cannot look it up there. It is a Windows specific and defined in winnt.h. Regarding reading resources it depends on your level of skill (home user, hobby programmer, expert, etc) - but the general resource for the ZIP format is: pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
    – jksoegaard
    Nov 24, 2020 at 5:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.