🔐 Private Folder Encryption Tool

A secure, lightweight PowerShell-based encryption solution for protecting sensitive directories using 7-Zip's AES-256 encryption with filename obfuscation.

✨ Features

• 🛡️ Military-Grade Encryption: AES-256 encryption with password-protected archives
• 👁️ Filename Obfuscation: Directory structure and filenames are encrypted (-mhe=on)
• 🔄 Bidirectional Operation: Seamlessly encrypt folders to archives and decrypt back
• 🚀 Admin Elevation: Automatic administrator rights request when needed
• 🎯 Smart Detection: Automatically detects whether to encrypt or decrypt based on file presence
• 🧹 Clean Workflow: Auto-cleanup of source files after successful operations
• 🔒 Stealth Mode: Archives are marked as hidden+system files
• ✅ Integrity Validation: Verifies archive creation and file sizes

📋 Requirements

• Windows with PowerShell 5.1+
• 7-Zip installed and available in PATH (7z.exe or 7za.exe)
  • Download from: 7-zip.org

🚀 Quick Start

Installation

1. Clone or download this repository
2. Ensure 7-Zip is installed and accessible via PATH
3. Run run_ps1_as_admin.cmd to execute the script with administrator privileges

Usage

Encrypting a Folder

1. Place your sensitive files in a folder named Private in the same directory as the script
2. Run run_ps1_as_admin.cmd
3. Enter your encryption password (twice for confirmation)
4. The script will:
   • Create Private.7z (encrypted, hidden archive)
   • Delete the original Private folder
   • Mark the archive as hidden+system

Decrypting an Archive

1. Run run_ps1_as_admin.cmd when Private.7z exists
2. Enter your decryption password
3. The script will:
   • Extract the archive to restore the Private folder
   • Delete the archive file
   • Leave your files accessible

🔧 Technical Details

Encryption Specifications

• Algorithm: AES-256
• Compression: User-selectable (1/5/9, default: 5)
  • 1 = Fast (minimal compression, fastest)
  • 5 = Normal (recommended - good balance)
  • 9 = Maximum (best compression, slowest)
• Header Encryption: Enabled (filenames encrypted)
• File Attributes: Hidden + System flags applied to archive

Security Features

• SecureString: Passwords handled via PowerShell's SecureString API
• Memory Protection: Immediate cleanup of plaintext passwords from memory
• Mandatory Confirmation: Double password entry required for encryption
• Strict Mode: PowerShell strict mode enabled to catch errors early

File Operations

Encryption Flow:
Private/ (folder) → Private.7z (hidden archive) → Private/ (deleted)

Decryption Flow:
Private.7z (archive) → Private/ (folder) → Private.7z (deleted)

📁 Project Structure

.
├── run_ps1_as_admin.cmd    # Launcher with admin elevation
├── script.ps1               # Main encryption/decryption logic
├── Private/                 # Your sensitive folder (when decrypted)
└── Private.7z              # Encrypted archive (when encrypted, hidden)

⚙️ Advanced Configuration

Custom 7-Zip Path

If 7-Zip is not in your PATH, modify the Find-7Zip function in script.ps1:

function Find-7Zip {
    # Add custom path
    $customPath = "C:\Program Files\7-Zip\7z.exe"
    if (Test-Path $customPath) { return $customPath }
    
    # Fallback to PATH search
    $exe = Get-Command 7z.exe -ErrorAction SilentlyContinue
    if ($exe) { return $exe.Source }
    return $null
}

Compression Level

The script prompts you to choose a compression level during encryption:

• Level 1 (Fast): Minimal compression, very fast (~2-5 seconds for typical folders)
• Level 5 (Normal): Default - balanced compression (~5-10 seconds)
• Level 9 (Maximum): Best compression, slow (~20-60 seconds)

Recommendation: Use level 5 for regular use. Level 9 provides only 5-15% better compression but takes 5-10x longer.

To skip the prompt and always use a specific level, modify script.ps1:

# Remove the user prompt section and set directly:
$compressionLevel = 5  # Your preferred level

🛡️ Security Considerations

✅ Best Practices

• Use strong, unique passwords (20+ characters recommended)
• Store passwords in a password manager
• Keep the encrypted archive in a backed-up location
• Test decryption immediately after encryption

⚠️ Limitations

• Password strength is critical - weak passwords can be brute-forced
• Archive file can be copied or stolen (relies on password security)
• No protection against keyloggers or memory dumps during password entry
• Deletion is standard (not secure wipe) - sensitive data may be recoverable

🔒 Enhanced Security Options

For maximum security, consider:

• Secure deletion: Use sdelete or similar tools to wipe the original folder
• Two-factor encryption: Create nested archives with different passwords
• Physical security: Store archives on encrypted drives (BitLocker, VeraCrypt)

🐛 Troubleshooting

"7-Zip not found in PATH"

• Install 7-Zip or add its installation directory to your system PATH
• Verify with: 7z --help in PowerShell

"Failed to create archive"

• Check available disk space
• Ensure you have write permissions in the directory
• Verify the Private folder exists and contains files

"Extraction failed: incorrect password"

• Password is case-sensitive
• Check for keyboard layout issues (Caps Lock, Num Lock)
• Ensure archive file is not corrupted

"Unable to delete archive/folder"

• Files may be in use by another program
• Close File Explorer windows showing the directory
• Run the script again to retry cleanup

📝 License

This project is provided as-is for personal and educational use. Modify and distribute freely.

🤝 Contributing

Contributions, issues, and feature requests are welcome! Feel free to check the issues page.

⚡ Performance

• Encryption: Speed depends on folder size and CPU (typically 10-50 MB/s)
• Decryption: Generally faster than encryption (20-100 MB/s)
• Memory: Minimal footprint, suitable for folders up to several GB

🔄 Changelog

v2.0 (Current)

• ✅ Removed redundant admin elevation
• ✅ Made password confirmation mandatory
• ✅ Added archive integrity validation
• ✅ Improved error visibility (7-Zip output now displayed)
• ✅ Enhanced UTF-8 encoding support
• ✅ Better error messages and cleanup handling
• ✅ User-selectable compression level (default: 5 for speed)

v1.0

• Initial release with basic encrypt/decrypt functionality

---

Made with 🔒 for privacy-conscious users

Report Bug · Request Feature