Recipe 8.15. Encrypting a File or Folder

Problem

You want to encrypt a file or folder so that other users cannot read its contents.

Solution

Using a graphical user interface

1. Open Windows Explorer.

2. In the left pane, browse to the parent folder of the file or folder you want to compress. Click on the parent folder. This displays the list of subfolders and files in the right pane.

3. In the right pane, right-click on the target file or folder and select Properties.

4. Click the Advanced button.

5. Check the box beside Encrypt contents to secure data.

6. Click OK and Apply.

Using a command-line interface

With the cipher.exe command you can encyrpt and decrypt files and folders. Running it without any options lists the files in the current directory with a flag indicating which ones are encrypted (U = unencrypted, E = encrypted):

> cipher

The following command encrypts a single file:

> cipher /e /a <FileName>

Here is an example:

> cipher /e /a mysecretfile.doc

The following command causes any new file added to the scripts directory to get encrypted. Existing files are not encrypted:

> cipher /e d:\scripts

The following command encrypts all files in a directory and any subdirectories:

> cipher /e /f /a /s:d:\scripts

This is the same command, with /e replaced by /d, which causes everything within the d:\scripts directory to become unencrypted:

> cipher /d /f /a /s:d:\scripts

Using downloadable software

A non-native, but standardized approach to encrypting files is to use Pretty Good Privacy (PGP). With PGP, not only can you encrypt local files, but you can also integrate it with your email client to securely send email. PGP is available for free from http://web.mit.edu/network/pgp.html. The commercial version can be purchased from http://www.pgp.com/.

Discussion

NTFS supports the Encrypting File System (EFS) for encrypting the contents of files. Similar to compression, EFS is built into the file system so encryption and decryption of EFS-enabled files and folders is seamless to the end-user. And just like compression, enabling EFS should only be done after much thought about its impact. EFS can have a significant hit on the performance of a computer and the access times for files.

For more on how to use EFS, including the recovery mechanisms built-in to EFS, see MS KB 324897.

See Also

MS KB 230520, "HOW TO: Encrypt Data Using EFS in Windows 2000," MS KB 298009, "Cipher.exe Security Tool for the Encrypting File System," and MS KB 324897, "HOW TO: Manage the Encrypting File System in Windows Server 2003 Enterprise Server"