Configure Encrypted File System Windows 11
To configure an encrypted file system in Windows 11, you use either BitLocker Drive Encryption for whole drives or the Encrypting File System (EFS) for individual files and folders. This article explains both methods, how to set them up, and how to choose between them.
What Is an Encrypted File System?
An encrypted file system protects data by converting readable files into ciphertext that only authorized users can decrypt with a key. Windows 11 offers two built-in encryption technologies: BitLocker and EFS. BitLocker encrypts entire volumes (drives), including the system drive, and is designed to protect data if a device is lost or stolen. EFS works at the file level, letting you encrypt specific files and folders without encrypting the whole drive. Both use AES (Advanced Encryption Standard) by default, but they serve different purposes.
How BitLocker Works
BitLocker uses a full-volume encryption key (FVEK) to encrypt data on the drive. The FVEK is itself encrypted with a volume master key (VMK), which is protected by one or more factors: a TPM (Trusted Platform Module), a PIN, a USB startup key, or a recovery key. When you boot Windows, the TPM validates the boot components and releases the VMK to decrypt the FVEK. If the TPM detects tampering or the drive is moved to another computer, the system asks for a recovery key before it will unlock the drive.
How EFS Works
EFS encrypts individual files using a symmetric file encryption key (FEK) that is unique to each file. The FEK is encrypted with the user’s public key, and the private key is stored in the user’s certificate store. When you access an encrypted file, Windows automatically decrypts it with your private key, so the process is transparent. EFS is tied to your Windows user account and certificate; if you lose your certificate or profile, you cannot recover the files unless you exported the certificate or designated a recovery agent.
How to Enable BitLocker on Windows 11
- Press Windows + I to open Settings, then go to System > Storage > Advanced storage settings > Disks & volumes.
- Select the drive you want to encrypt, click Properties, then click Turn on BitLocker.
- Choose how to unlock the drive: using a TPM, a PIN, or a USB key. If your device has a TPM 2.0, you can use the TPM alone or add a PIN.
- Save or print your recovery key. This is critical—if you lose it, you may be permanently locked out of your data.
- Choose whether to encrypt the used space only or the entire drive, then start the encryption process. It may take minutes to hours depending on drive size.
How to Enable EFS on Windows 11
- Open File Explorer and right-click the file or folder you want to encrypt.
- Select Properties, then click Advanced.
- Check the box Encrypt contents to secure data and click OK.
- If encrypting a folder, choose whether to apply the encryption to the folder only or to all subfolders and files.
- Click OK again. The file or folder name will appear green in File Explorer.
BitLocker vs. EFS: Which Should You Use?
The choice depends on what you need to protect. Use BitLocker when you want to protect the entire system drive or a removable drive from theft—for example, a laptop that could be stolen. Use EFS when you need to protect specific files on a shared computer without encrypting the whole drive, or when you want other users to still access the rest of the system normally. EFS is not available on Windows 11 Home; it requires Pro, Enterprise, or Education editions. BitLocker is also absent from Home, but you can use Device Encryption on Home if your device supports it (it is enabled by default on many modern laptops).
Common Problems and Solutions
- BitLocker asks for a recovery key after a BIOS update: This is normal because the boot configuration changed. Enter the recovery key, then consider updating your TPM or disabling BitLocker temporarily before future updates.
- EFS encrypted files are inaccessible after reinstalling Windows: You must have exported your EFS certificate and private key before reinstalling. Without it, the data is unrecoverable.
- BitLocker is slow: Encryption and decryption add overhead, especially on older drives. Using a hardware-encrypted SSD or disabling BitLocker on non-sensitive drives can help.
- Cannot enable BitLocker because TPM is off: Go to BIOS/UEFI settings and enable TPM (often labeled Intel PTT or AMD fTPM).
Frequently Asked Questions
Does BitLocker slow down my computer?
BitLocker adds a small performance overhead because data is encrypted and decrypted on the fly. On modern CPUs with AES-NI instructions, the impact is usually negligible—often less than a few percent. On older hardware or mechanical hard drives, you may notice a slowdown, especially during large file transfers.
Can I use EFS on Windows 11 Home?
No. EFS is only available in Windows 11 Pro, Enterprise, and Education editions. Windows 11 Home users can use Device Encryption (a form of BitLocker) if their device meets the requirements, or they can upgrade to Pro to get EFS.
What happens if I lose my BitLocker recovery key?
Without the recovery key, you cannot unlock the drive. If you have a Microsoft account, the key may be backed up to your account online. Otherwise, you will need to reset the device, which erases all data. Always save the key in a safe place, preferably offline.
Can I encrypt only one folder with BitLocker?
No. BitLocker encrypts entire volumes, not individual folders. To encrypt a single folder, use EFS instead. Alternatively, you can create a virtual hard disk (VHD) file, encrypt it with BitLocker, and store the folder inside it.
Is it safe to back up encrypted files to the cloud?
Yes, but the encryption is only as strong as the key. If you back up a BitLocker-encrypted drive to the cloud, the data remains encrypted, but the recovery key must be kept secure. EFS files, however, are decrypted when you copy them to a non-NTFS drive or a cloud folder, so they lose encryption. Use a separate encryption tool for cloud backups if needed.
How do I decrypt a file or drive later?
For EFS, right-click the file, go to Properties > Advanced, and uncheck the encryption box. For BitLocker, open Settings > System > Storage > Disks & volumes, select the drive, and click Turn off BitLocker. Decryption takes time and requires admin rights.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.