Encrypted files (Windows EFS)


EFS is a Windows feature that allows you to encrypt individual files on disk. GBM supports backing up EFS-encrypted files on Windows. The files will be silently decrypted if possible (e.g. if GBM is running as the encryption user, or if GBM is running as the EFS Recovery Agent user).


If it is not possible to automatically decrypt the file for backup, GBM will back up the file in its encrypted form, and will only be able to restore it in its encrypted form. EFS-encrypted files are displayed with green text in the Restore browser dialog in the GBM interface.


If you have a PC failure, the EFS encryption keys may be lost. In this situation, the EFS-encrypted files may be unusable, even after restoring from backup. GBM warns you about this situation by adding a warning message in the backup job log.

In order to safely prepare for this scenario, you should export the PC's EFS encryption keys, so that the files can be accessed after a PC failure. On Windows, you can do this via certmgr.msc; or on Windows Server, taking a System State backup may be sufficient.


Once you have safely backed up the PC's EFS encryption keys, you can suppress the warning in GBM by enabling the "I confirm EFS keys are exported" option in the Protected Item settings.

If you have only a partial PC failure (e.g. files lost, but OS installation and user accounts remain intact) the EFS-encrypted files will be restorable without any further attention to the EFS keys. 


Finding files using EFS


You can use the cipher /u /n command to list all files on the local PC that are EFS-encrypted.

Alternatively, you can use this Powershell snippet, to list all EFS-encrypted files on C:\ into a new EFS-FileList.txt file:

get-childitem C:\ -Recurse -Force -ErrorAction SilentlyContinue | Where-Object {$_.Attributes -ge "Encrypted"} | format-list fullname, attributes | Out-File -FilePath .\EFS-FileList.txt -NoClobber

Finding the certificate used to encrypt a file


You can use the cipher /C C:\path\to\file.txt command to display the user accounts and certificates that are able to decrypt a file. This may indicate which user originally encrypted the file and/or which EFS certificates are necessary for backup.