How to Find and Detect Encrypted Files on a Computer

Finding Encrypted Files (Windows)

Type cmd into the Windows search bar. You'll usually see the search bar at the bottom-left corner of the screen. If you don't see it, click the magnifying glass or circle to open it. You can also pull up the search with ⊞ Win+S. Search results will appear as you type.

Click Command Prompt in the search results. This opens a black window with a command prompt inside.

Type cipher /u /n and press ↵ Enter. A list of all the encrypted files on your computer and their locations will appear along with their locations on your hard drive. If you want to decrypt a file, make note of the location and continue with this method.

Decrypting Files (Windows)

Open File Explorer. You can find this on your Start menu or by pressing ⊞ Win+E.

Navigate to the folder that contains the file you want to decrypt.

Right-click the encrypted file/folder and select Properties. This opens a dialog box to the "General" tab.

Click Advanced. It's in the "Attributes" section.

Uncheck the box next to “Encrypt Contents to Secure Data."

Click Ok twice. All the pop-up boxes will disappear and your file will be decrypted instantly. If this does not work, you may not have the ability or permission to decrypt this file, which may indicate malicious software.

Finding Encrypted Files (Mac)

Open Finder Mac Finder. It's the first icon on the Dock, which is usually at the bottom of your desktop.

Click the File menu. It's at the top-left corner of the screen.

Click Find. You can also press ⌘ Cmd+F.

Click the Kind drop-down box. You’ll see this immediately under the tool bar.

Click Other from the drop-down box. The options will change.

Click Security in the attributes list.

Check the “In Menu” box. A checked box indicates this is enabled. You can now browse your folders for encrypted files.

Decrypting Files (Mac)

Open Terminal. You can find this by searching Spotlight or in the Utilities folder of Finder.

Type the following code: openssl enc -aes-256-cbc -d -in *path-to-file-you-want-to-decrypt* -out *path-to-where-the-decrypted-file-will-be-saved*.

Press ⏎ Return. You'll be prompted for a password.

Type the admin password and press ⏎ Return.

Press ⏎ Return. You'll find the decrypted file in the location you specified in Terminal.