Find encrypted (EFS) or Hidden files

Microsoft Windows
Post Reply
User avatar
MigrationUser
Posts: 336
Joined: 2021-Jul-12, 1:37 pm
Contact:

Find encrypted (EFS) or Hidden files

Post by MigrationUser »

07 Nov 2008 19:42
drifty

Is there a simple way to find out if a drive contains any EFS or Hidden files or folders?

----------------------------

#2 11 Nov 2008 20:54
bluesxman


You could do something like this:

Code: Select all

attrib /s c:\ 2>nul| findstr "^...S ^....H" >nul && echo:Hidden or system files found"
cipher /s c:\ | findstr "^.E" && echo:Encrypted files found
Last edited by bluesxman (11 Nov 2008 21:08)

cmd | *sh | ruby | chef

----------------------------

#3 24 Nov 2008 20:47
drifty


Did some work on this and it seems to work except for echo to the screen and logging. I am trying to find a quick way to find EFS, Hidden and Zero Byte files after a copy. The message is displayed for any hidden folders but I can't seem to get it to display and log the path/file name for an EFS files. Any suggestions would be appreciated.
CODE

Code: Select all

@echo off
cls

:: Set the varibles - Use Quotes "" if there are spaces in the source or log path
set source_path="C:\Test Set_1"
set log_path=G:\AB561\Logs

:: Find Encrypted Files
cipher %source_path%\* | findstr "^.E" >> %log_path%\attribute.txt && echo:Encrypted files found"

:: Find Hidden Files
attrib /S %source_path%\*.* 2>nul | findstr "^....H" >> %log_path%\attribute.txt && echo:Hidden files found"

:: Find Zero Byte Files
for /f "usebackq tokens=*" %%a in (`dir /a:-d /b/s %source_path%`) do (
        if "%%~za" EQU "0" echo:%%a
) >> %log_path%\attribute.txt

pause
----------------------------

#4 25 Nov 2008 12:39
bluesxman


Nothing looks to be wrong to me.

Indeed, I copied and pasted your cipher and attrib commands out and ran them against hidden/encrypted files on my machine.

They worked fine -- attributes.txt contains the list of encrypted/hidden files and it echoes to screen that it found the file types.

Are you sure the hidden/encrypted files are being copied?
I.E. are they at the destination location you're testing against?

Last edited by bluesxman (25 Nov 2008 12:40)
Post Reply