NTFSDECRYPT(8)

💅 NTFSDECRYPT(8) — the ntfsdecrypt era

okay so bestie, welcome to ntfsdecrypt, straight out of the System Manager's Manual. this is the girl whose whole job is decrypting or updating NTFS files that got encrypted with EFS. she's niche, she's powerful, she's lowkey carrying your whole backup plan 🫶

---

✨ SYNOPSIS ✨

ntfsdecrypt [options] -k key.pfx device file

---

🦋 DESCRIPTION 🦋

So here's the vibe: ntfsdecrypt decrypts a file from an unmounted device and prints the decrypted data straight onto the standard output. She can also update an encrypted file while keeping the encryption key unchanged. multi-talented, no cap 💅

NTFS file encryption (aka EFS) is a two-level situation, and honestly it's giving layered security realness:

1. first, the file contents get encrypted with a random symmetric key
2. then that symmetric key gets encrypted with the public keys of each of the users allowed to decrypt the file (RSA public key encryptions, iykyk)

Three symmetric encryption modes are currently implemented in ntfsdecrypt: DESX (a DES variant), 3DES (triple DES) and AES_256 (an AES variant). three icons, one program ✨

All the encrypted symmetric keys are stored along with the file in a special extended attribute named "$LOGGED_UTILITY_STREAM". usually at least two users are allowed to read the file: its owner and the recovery manager, who is able to decrypt all the files in a company. main character energy fr 👑

⚠️ when you're backing up an encrypted file, it is important to also back up the corresponding $LOGGED_UTILITY_STREAM — otherwise the file cannot be decrypted, even by the recovery manager. like, not even the boss can save you 😭 also note that encrypted files are slightly bigger than apparent, and the option "efs_raw" has to be used when backing up encrypted files with ntfs-3g. do not skip that part bestie.

When ntfsdecrypt is used to update a file, the keys and the $LOGGED_UTILITY_STREAM are kept unchanged, so a single key file has to be designated. one key, that's the whole assignment 🎀

📌 Note: the EFS encryption is only available in professional versions of Windows. humble flex, but only if you paid for the pro tier 🙈

---

🌸 OPTIONS 🌸

Below is a summary of all the options that ntfsdecrypt accepts. nearly all options have two equivalent names — the short name is preceded by - and the long name is preceded by --. any single letter options that don't take an argument can be combined into a single command, e.g. -fv is equivalent to -f -v. long named options can be abbreviated to any unique prefix of their name. shortcuts slay ✨

• -i, --inode NUM — display or update the contents of a file designated through its inode number instead of its name. forget the name, we're going by the digits 🧚
• -e, --encrypt — update an existing encrypted file and get the new contents from the standard input. the full public and private key file has to be designated, because the symmetric key is kept unchanged, so the private key is needed to extract it. private key stays booked and busy 🔥
• -f, --force — this will override some sensible defaults, such as not using a mounted volume. use this option with caution, bestie — it's giving reckless, and not in the cute way 💀
• -k, --keyfile-name key.pfx — define the file which contains the public and private keys in PKCS#12 format. this file obviously contains the keys of one of the users allowed to decrypt or update the file. it has to be extracted from Windows in PKCS#12 format (its usual suffix is .p12 or .pfx), and it is protected by a passphrase which has to be typed in for the keys to be extracted. this can be the key file of any user allowed to read the file — including the one of the recovery manager 👑🫶
• -h, --help — show a list of options with a brief description of each one. the classic "what does anything do" moment 🌈
• -q, --quiet — suppress some debug/warning/error messages. she's being demure 🎀
• -V, --version — show the version number, copyright and license of ntfsdecrypt. receipts, available on demand 🧾
• -v, --verbose — display more debug/warning/error messages. she's yapping, and honestly we love that 💖

---

⭐ EXAMPLES ⭐

Display the contents of the file hamlet.doc in the directory Documents of the root of the NTFS file system on the device /dev/sda1:

ntfsdecrypt -k foo.key /dev/sda1 Documents/hamlet.doc

Update the file hamlet.doc:

ntfsdecrypt -k foo.key /dev/sda1 Documents/hamlet.doc < new.doc

see? same command, different energy. new.doc slides in through the stdin door and the keys stay exactly where they were 😌

---

💀 BUGS 💀

There are no known problems with ntfsdecrypt. literally flawless, we cheer 🎉

If you do find a bug, please send an email describing the problem to the development team: ntfs-3g-devel@lists.sf.net. be descriptive, be kind, attach the deets 💌

---

🧚 AUTHORS 🧚

ntfsdecrypt was written by Yuval Fledel, Anton Altaparmakov and Yura Pakhuchiy. it was ported to ntfs-3g by Erik Larsson and upgraded by Jean-Pierre Andre. icons, the whole lot of them ✨

---

🌈 AVAILABILITY 🌈

ntfsdecrypt is part of the ntfs-3g package and is available from:

https://github.com/tuxera/ntfs-3g/wiki/

go get her 🫶

---

👑 SEE ALSO 👑

Read ntfs-3g(8) for details on option efs_raw — yes, the one from the warning above, that's the one 🎀

Also check out ntfscat(8), ntfsprogs(8). the whole friend group, fr fr 💜

---

💖 that's the whole page bestie. go decrypt something. mind the $LOGGED_UTILITY_STREAM, back it up, and never -f a mounted volume without thinking twice 💅

ntfsdecrypt — from ntfs-3g 2026.9.28, dated June 2014. old page, immaculate vibes, still slaying. 🦋🌸