The standard Windows feature for this is EFS (Encrypting File System). EFS transparently decrypts files on read, and re-encrypts them on write. It uses an encryption key that is randomly generated, and itself encrypted with a public key whose private key is encrypted with a key derived from your password. If somebody resets your password (either using an admin interface, or by directly editing the SAM on the disk), the EFS key is unrecoverable.
EFS requires Professional (or higher) editions of Windows. It can be applied to files or to folders; it doesn't technically do anything to a folder but it makes it so all the files within the folder will, be default, be encrypted. EFS by default encrypts the file key with the public keys of all users who already have read access to the file, so it shouldn't interfere with computer usage at all (it does take slightly more space - the encrypted keys and other metadata are stored alongside the file - and of course requires more CPU to do more work, though crypto is faster than all but the quickest disk interfaces these days). NTFS is the only supported file system for EFS (most others don't support the file flag or the alternate data streams used for metadata) so you can't use it on FAT32 or EXFAT or anything (you can use EFS on removable media you've reformatted it to NTFS, though).
To enable EFS on a file or directory, you can use Windows Explorer (GUI file browser) or the command-line cipher.exe
tool. For Explorer, open the "Properties" for the file/folder, click the "Advanced" button under the "General" tab (which is the default tab), and then click "Encrypt contents to secure data" and click "OK" to close each window. On a directory, it might ask you to confirm that you want to encrypt all files currently in the directory. The process might take a little while; it's got to overwrite every file with the encrypted data. For help with the command line tool, run cipher /?
from a terminal, but the command you probably want is something like cipher /E /S <sensitive> <directories>
, which will encrypt the paths <sensitive>
and <directories>
and all files and subdirectories within them. It is recommended to not encrypt files without adding the flag to the directory they're in too, as otherwise modifying the file might cause it to become unencrypted (depending on how the write is done).
The better solution against this entire class of problems is to encrypt the entire system (and data, if separate) volume. Higher editions of Windows have a feature for this, called BitLocker. There's also third-party software, such as VeraCrypt. Full volume encryption is safer than file encryption for a number of reasons: attackers can't even read file system metadata (names and lengths of files, etc.), you don't have to worry about anything having been left unencrypted, it's very difficult to make any modifications to the disk (such as messing with the admin password) without rendering the whole system unbootable (plausibly not impossible but still designed to be difficult even if you know exactly where to write), and is in fact practically impossible to introduce targeted changes to the disk that will make any sense once it's decrypted if you don't know what's already there.
Full volume encryption is fully transparent once the system is booted, but possibly complicates booting a little. The system needs some way to get the decryption key at boot. This can be off a file on a flashdrive, from a passphrase you enter, or various other ways. One option (which BitLocker uses by default on compatible systems) is called a TPM or Trusted Platform Module; the TPM can securely store ("seal") keys in a way that they are unavailable unless the system's boot process is identical to how it was when the key was sealed. This allows booting transparently under normal conditions, but prevents decrypting the BitLockered volumes if somebody tries to boot the machine off removable media, or remove the hard disk and connect it to another computer. TPM-only mode is a bit less secure than in combination with other things like a password, though, due to attacks such as letting the machine boot (all the way to the login screen) then opening it up and trying to extract the encryption key from the physical RAM without shutting down again.
For BitLocker, just right-click on the drive(s) you want encrypted, and choose "Turn on BitLocker". You can also use the manage-bde.exe
command-line tool. Note that the GUI will, by default, try to use TPM-only mode; you can change this behavior using the Group Policy Editor (gpedit.msc
, "Local Computer Policy" -> "Computer Configuration" -> "Administrative Templates" -> "Windows Components" -> "BitLocker Drive Encryption" -> "Operating System Drives" and then configure "Require additional authentication at startup" and optionally "Allow enhanced PINs at startup" if you want to allow a normal passphrase) or configure it manually using manage-bde
.
If either of these features are unavailable, you probably need to upgrade your Windows edition (the Home editions don't have them). This can be done in place if you get a suitable key. You can also use third-party software such as VeraCrypt for the full volume encryption.