Encrypted files (Windows EFS)

EFS is a Windows feature that allows you to encrypt individual files on disk. Magnus Box supports backing up EFS-encrypted files on Windows. The files will be silently decrypted if possible (e.g. if Magnus Box is running as the encryption user, or if Magnus Box is running as the EFS Recovery Agent user).

If it is not possible to automatically decrypt the file for backup, Magnus Box will back up the file in its encrypted form, and will only be able to restore it in its encrypted form. EFS-encrypted files are displayed with green text in the Restore browser dialog in Magnus Box.

If you have a PC failure, the EFS encryption keys may be lost. In this situation, the EFS-encrypted files may be unusable, even after restoring from backup. Magnus Box warns you about this situation by adding a warning message in the backup job log.

In order to safely prepare for this scenario, you should export the PC's EFS encryption keys, so that the files can be accessed after a PC failure. On Windows, you can do this via certmgr.msc; or on Windows Server, taking a System State backup may be sufficient.

Once you have safely backed up the PC's EFS encryption keys, you can suppress the warning in Magnus Box Backup by enabling the "I confirm EFS keys are exported" option in the Protected Item settings.

If you have only a partial PC failure (e.g. files lost, but OS installation and user accounts remain intact) the EFS-encrypted files will be restorable without any further attention to the EFS keys.

You can use the cipher /u /n command to list all files on the local PC that are EFS-encrypted.

You can use the cipher /C C:\path\to\file.txt command to display the user accounts and certificates that are able to decrypt a file. This may indicate which user originally encrypted the file and/or which EFS certificates are necessary for backup