Unable to decrypt EFS files with cipher command

I tried to decrypt a EFS file with the built-in cipher command: cipher -d "D:\sample.txt", and here's the output:

Listing C:\Windows\System32\
New files added to this directory will not be encrypted.

Listing D:\
New files added to this directory will not be encrypted.

E sample.txt

Here's the screenshot. After the command was executed, I rebooted my computer and found the target file is still protected by EFS. How can I get the cipher command to work? The system is Windows 10. Thanks!

Update: Here's what I got when run the command cipher "D:\*":

 Listing D:\
 New files added to this directory will not be encrypted.

E sample.txt

E.Swaff

Posted 2018-11-30T03:07:30.827

Reputation: 71

1I assume you have the certificate used to encrypt the file installed on your system? I also assume you are using an edition of Windows 10 that even supports EFS. Edit your question and provide the relevant information necessary to answer your question. Your syntax also looks to be incorrect. *You are using -d which specifies a directory but you're attempting to decrypt a text file instead of the directory it's in. Your output clearly indicates the file, after you attempt to decrypt it, is still encrypted. – Ramhound – 2018-11-30T03:12:22.387

Edit your question, and provide the text output of the following command, cipher "D:\*". I suggest you move sample.txt to a different directory though and provide the encryption status of that folder instead. – Ramhound – 2018-11-30T03:17:03.977

@Ramhound Thanks for your quick repsonse! Windows 10 Pro version 1803. The target file was encrypted by myself, and the EFS certificate should have been saved locally. – E.Swaff – 2018-11-30T03:19:08.723

I still want the information I requested. – Ramhound – 2018-11-30T03:21:39.893

@Ramhound I've edited the question. – E.Swaff – 2018-11-30T03:28:10.153

I think the syntax is correct. The switch -d means decrypt. – E.Swaff – 2018-11-30T03:32:48.127

The documentation states that "By default, cipher skips files that have been encrypted or decrypted already.", which means you must also use /f when you use /d. So the command should instead be cipher /d /f "D:\sample.txt" – Ramhound – 2018-11-30T04:08:59.033

It seems that I should use "/d" instead of "-d". Now it works. Thanks a lot! – E.Swaff – 2018-12-13T02:27:17.203

I actually said that nearly 10 days ago. – Ramhound – 2018-12-13T02:42:52.943

Unable to decrypt EFS files with cipher command

Answers