Windows – Encrypted folders and files stay encrypted when copied

You need to backup your file encryption key and restore it on another computer.

Due to the way the system works, you may have to restore it to a user that has exactly the same log-in and password. If this is inconvenient, you have to use other means of encryption.

The reason for this is a known compatibility issue with the built-in macOS Archive program and the built-in unzipper in various Windows versions.

When you use the "Compress" tool built-in to Finder, you'll get a ZIP-file. The ZIP-file contains, amongst other things, what is known as "external file attributes" for each file. These attributes are host-system dependent (i.e. these attributes are not guaranted to be understood the same way on various operating systems).

Unfortunately, one of the attributes that the macOS tools marks the files with are interpreted by the Windows built-in unzip tool as marking the file as "encrypted" (which is a special form of single-file encryption built-in to the NTFS file system). This means that when unzipped the files have the encrypted attribute and their names are shown in green in the Windows Explorer.

However, there are no significant downsides to this as you can easily open Properties on the files and remove the checkmark on the "encrypted" attribute. The file contents is not really encrypted, so the files can be opened as always.

You can avoid this issue by either using a different compression tool on the Mac, or by using a different decompression tool on Windows.

The technical details are as follows:

The problem is caused by the Windows unzipper incorrectly parsing the "external file attributes" in the ZIP-header for each file/folder. This element of the header is host-dependent, as such the unzipper should check the element of the centrall directory file header known as "Version made by" to inspect which operating system made the file. The macOS compression tool correctly stores the attribute value 3 for "Unix" here.

Unfortunately the Windows tool disregards this value and always interprets the file attributes as though they were created on Windows. The "encryption" issue comes from the fact that ZIP-files created on Windows stores file attributes according to the file attribute constants (FILE_ATTRIBUTE_<...>) defined by Microsoft. In particular FILE_ATTRIBUTE_ENCRYPTED defined by the value 0x4000 means encrypted file or directory. However Unix-systems use the POSIX constants where S_IFDIR is the attribute that means "this is a folder" - and is typically defined as the value 0040000, which is equivalent to 0x4000.