peass-ng/PEASS-ng · error · NotSupportedException

The drive does not support NTFS encryption: [{0}]

Error message

The drive does not support NTFS encryption: [{0}]

What it means

EncryptDecryptFileCore translates Win32 ERROR_ACCESS_DENIED into NotSupportedException('The drive does not support NTFS encryption') when the volume hosting the path is not NTFS. EFS (EncryptFile/DecryptFile) only works on NTFS; other filesystems (FAT32, exFAT) deny the call, and AlphaFS reports the real cause via the drive root in the message.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/AlphaFS/Filesystem/File Class/File Core Methods/File.EncryptDecryptFileCore.cs:100

            if (isReadOnly)
               attrs.dwFileAttributes |= FileAttributes.ReadOnly;

            if (isHidden)
               attrs.dwFileAttributes |= FileAttributes.Hidden;

            SetAttributesCore(null, isFolder, path, attrs.dwFileAttributes, pathFormat);
         }


         if (!success)
         {
            switch ((uint) lastError)
            {
               case Win32Errors.ERROR_ACCESS_DENIED:

                  if (!string.Equals("NTFS", new DriveInfo(path).DriveFormat, StringComparison.OrdinalIgnoreCase))

                     throw new NotSupportedException(string.Format(CultureInfo.InvariantCulture, "The drive does not support NTFS encryption: [{0}]", Path.GetPathRoot(path, false)));

                  break;


               case Win32Errors.ERROR_FILE_READ_ONLY:

                  if (isFolder)
                     throw new DirectoryReadOnlyException(path);

                  else
                     throw new FileReadOnlyException(path);


               default:
                  NativeError.ThrowException(lastError, isFolder, path);
                  break;
            }
         }

View on GitHub (pinned to 53fb989abc)

Solutions

1. Move/copy the file to an NTFS volume before encrypting
2. Reformat the target drive as NTFS if EFS is required (data loss risk)
3. Check DriveInfo(path).DriveFormat == "NTFS" before calling Encrypt/Decrypt and skip non-NTFS volumes
4. Use an alternative encryption method (e.g. System.Security.Cryptography) for non-NTFS media

Example fix

// before
File.Encrypt(filePath);
// after
if (string.Equals("NTFS", new DriveInfo(Path.GetPathRoot(filePath)).DriveFormat, StringComparison.OrdinalIgnoreCase))
    File.Encrypt(filePath);
else
    SkipNonNtfsEncryption(filePath);

bool isNtfs = string.Equals("NTFS", new DriveInfo(Path.GetPathRoot(path)).DriveFormat, StringComparison.OrdinalIgnoreCase);
if (!isNtfs) throw new NotSupportedException("EFS requires NTFS volume: " + path);

bool SupportsEfs(string path) { var root = Path.GetPathRoot(path); return root != null && new DriveInfo(root).IsReady && string.Equals("NTFS", new DriveInfo(root).DriveFormat, StringComparison.OrdinalIgnoreCase); }

try { File.Encrypt(path); }
catch (NotSupportedException ex) { Log(ex.Message); UseAlternativeEncryption(path); }

When it happens

Trigger: Calling File.Encrypt or File.Decrypt on a file located on a FAT32/exFAT/USB/network volume; native call fails with ERROR_ACCESS_DENIED and DriveInfo(path).DriveFormat != 'NTFS'.

Common situations: Encrypting files on USB sticks or SD cards formatted exFAT; working from a network share (no EFS); WSL-mounted or virtual drives; moving data off an NTFS partition onto removable media.

Related errors

• Value cannot be null. Parameter name: path
• Creating hard-links on non-NTFS partitions is not supported.
• ERROR_FILE_READ_ONLY
• PEASS local file (#{url_peass}) does not exist!
• Something falied reading PEASS script from #{url_peass}

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/77fde6ffe78d77d9. Report an issue: GitHub.