Manual: ntfsdecrypt

NTFSDECRYPT(8)					   System Manager's Manual				      NTFSDECRYPT(8)

NAME
       ntfsdecrypt - decrypt or update NTFS files encrypted according to EFS

SYNOPSIS
       ntfsdecrypt [options] -k key.pfx device file

DESCRIPTION
       ntfsdecrypt  decrypts  a	 file  from an unmounted device and print the decrypted data on the standard output.  It can
       also update an encrypted file with the encryption key unchanged.

       The NTFS file encryption (known as EFS) uses a two-level encryption : first, the file contents is  encrypted  with  a
       random  symmetric  key, then this symmetric key is encrypted with the public keys of each of the users allowed to de‐
       crypt the file (RSA public key encryptions).

       Three symmetric encryption modes are currently implemented in ntfsdecrypt : DESX (a DES variant), 3DES  (triple	DES)
       and AES_256 (an AES variant).

       All  the encrypted symmetric keys are stored along with the file in a special extended attribute named "$LOGGED_UTIL‐
       ITY_STREAM".  Usually, at least two users are allowed to read the file : its owner and the recovery  manager  who  is
       able  to	 decrypt  all the files in a company.  When backing up an encrypted file, it is important to also backup the
       corresponding $LOGGED_UTILITY_STREAM, otherwise the file cannot be decrypted, even by the recovery manager. Also note
       that encrypted files are slightly bigger than apparent, and the option "efs_raw" has to be used when backing  up	 en‐
       crypted files with ntfs-3g.

       When  ntfsdecrypt  is  used to update a file, the keys and the $LOGGED_UTILITY_STREAM are kept unchanged, so a single
       key file has to be designated.

       Note : the EFS encryption is only available in professional versions of Windows;

OPTIONS
       Below is a summary of all the options that ntfsdecrypt accepts.	Nearly all options have two equivalent	names.	 The
       short name is preceded by - and the long name is preceded by --.	 Any single letter options, that don't take an argu‐
       ment, can be combined into a single command, e.g.  -fv is equivalent to -f -v.  Long named options can be abbreviated
       to any unique prefix of their name.

       -i, --inode NUM
	      Display or update the contents of a file designated through its inode number instead of its name.

       -e, --encrypt
	      Update  an  existing encrypted file and get the new contents from the standard input. The full public and pri‐
	      vate key file has to be designated, as the symmetric key is kept unchanged, so the private key  is  needed  to
	      extract it.

       -f, --force
	      This will override some sensible defaults, such as not using a mounted volume.  Use this option with caution.

       -k, --keyfile-name key.pfx
	      Define  the  file	 which contains the public and private keys in PKCS#12 format.	This file obviously contains
	      the keys of one of the users allowed to decrypt or update the file. It has to be	extracted  from	 Windows  in
	      PKCS#12  format  (its usual suffix is .p12 or .pfx), and it is protected by a passphrase which has to be typed
	      in for the keys to be extracted. This can be the key file of any user allowed to read the file, including	 the
	      one of the recovery manager.

       -h, --help
	      Show a list of options with a brief description of each one.

       -q, --quiet
	      Suppress some debug/warning/error messages.

       -V, --version
	      Show the version number, copyright and license of ntfsdecrypt.

       -v, --verbose
	      Display more debug/warning/error messages.

EXAMPLES
       Display the contents of the file hamlet.doc in the directory Documents of the root of the NTFS file system on the de‐
       vice /dev/sda1

	      ntfsdecrypt -k foo.key /dev/sda1 Documents/hamlet.doc

       Update the file hamlet.doc

	      ntfsdecrypt -k foo.key /dev/sda1 Documents/hamlet.doc < new.doc

BUGS
       There  are  no known problems with ntfsdecrypt.	If you find a bug please send an email describing the problem to the
       development team:
       ntfs-3g-devel@lists.sf.net

AUTHORS
       ntfsdecrypt was written by Yuval Fledel, Anton Altaparmakov and Yura Pakhuchiy.	It was ported  to  ntfs-3g  by	Erik
       Larsson and upgraded by Jean-Pierre Andre.

AVAILABILITY
       ntfsdecrypt is part of the ntfs-3g package and is available from:
       https://github.com/tuxera/ntfs-3g/wiki/

SEE ALSO
       Read ntfs-3g(8) for details on option efs_raw,
       ntfscat(8), ntfsprogs(8)

ntfs-3g 2022.10.3					  June 2014					      NTFSDECRYPT(8)