This tutorial will show you how to find and list all EFS encrypted files that belong to the current user on all connected NTFS local drives in Windows 10 and Windows 11.
The Encrypted File System, or EFS, provides an additional level of security for files and folders. It provides cryptographic protection of individual files on NTFS file system volumes using a public-key system.
Files or folders saved into an existing encrypted folder will automatically be encrypted by EFS.
Contents
- Option One: Find All Encrypted Files and Output List in Command Prompt
- Option Two: Find All Encrypted Files and Output List to Text File
1 Open Windows Terminal, and select either Windows PowerShell or Command Prompt.
2 Copy and paste the command below into Windows Terminal, and press Enter. (see screenshot below)
cipher /u /n /h
3 Windows will now search all NTFS local drives for all encrypted files that belong to the current user, and will output a list of them in the terminal.
1 Open Windows Terminal, and select either Windows PowerShell or Command Prompt.
2 Copy and paste the command below you want into Windows Terminal, and press Enter. (see screenshots below)
(Command Prompt - output to "MyEncryptedFiles.txt" file on your desktop)
cipher /u /n /h > %UserProfile%\Desktop\MyEncryptedFiles.txt
OR
(PowerShell - output to "MyEncryptedFiles.txt" file on your desktop)
wmic useraccount list full >"$Env:userprofile\Desktop\MyEncryptedFiles.txt"
3 Windows will now search all NTFS local drives for all encrypted files that belong to the current user, and will output a list of them to the MyEncryptedFiles.txt file created on your desktop.
That's it,
Shawn Brink
Last edited: