Here's my situation.

Was using EFS on my Vista laptop - had a backup of my certificate.

HD crashed...managed to recover some of my files (Encrypted) - but they "lost" the "Encrypted" attribute in the process.

I'm now on my new Windows 7 Enterprise laptop - imported my old Vista EFS certificate...I have my files on a USB drive and copied them over to my new drive (NTLM), but as I mentioned, Windows doesn't see them as being Encrypted...so I can't decrypt them.

Is there a way to either force the Encrypt attribute to be set, so that I'll then be able to decrypt them...or to force-decrypt them manually even though the system doesn't see the file as being encrypted?

  • 3
    NTLM is a network authentication protocol, not a filesystem. Did you mean NTFS?
    – user1686
    May 31, 2011 at 18:11

2 Answers 2


The EFS keys are kept in NTFS alternate data streams, so if your USB drive was not formatted as an NTFS drive, the information would be lost. Backup programs often discard this information as well.

You can check if the streams are still there using Streams or ADS Spy. If they are no longer there, it will be impossible for you to recover your files.

As Windows does not flag the files as EFS encrypted, I think it is likely that you have lost the EFS keys in the streams.

  • 2
    I really like this answer because it provides critically valuable information. May 31, 2011 at 18:19
  • 1
    For those who like FAR Manager, there is also a free and open-source plug-in (32-bit and 64-bit binaries are also available) that provides full access to NTFS alternate data streams (use the F11 key to access this plug-in after installing it): code.google.com/p/farplug/#NTFS_File_Information May 31, 2011 at 18:32

Unfortunately the ATTRIB command wasn't updated accordingly, so it cannot change this attribute.

There is a fantastic tool called FAR Manager which will allow you to change this and all other attributes:

  FAR Manager (free and open source)

Within this program, you simply navigate to the file or directory for which you wish to change the attribute(s) for, then press CTRL-A -- "Encrypted" is one of the attributes you can change in the dialogue that will appear:

enter image description here

Additionally, if you select a number of files first (press the Insert key on your keyboard to select files individually, or use the + or - keys to select or de-select groups of files based on a pattern), you can then press CTRL-A to change the attributes for all of them at once.

HELPFUL TIP: When you're finished using this program, you can press F10 to exit.

For those who are interested, the full list of editable attributes are:

  • Read only
  • Archive
  • Hidden
  • System
  • Compressed
  • Encrypted
  • Not indexed
  • Sparse
  • Temporary
  • Offline
  • Reparse point
  • Virtual

...and other details that you can change include:

  • Owner
  • File modification date and time
  • File creation date and time
  • Last file access date and time

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.