Post

(reading Windows Internals) "EFS then encrypts the FEK using the user’s asymmetric public key and stores the encrypted FEK in the EFS alternate data stream for the file" encrypt file -> `dir /r` -> no EFS stream >:(