What does NTSTATUS 0xC00004A7 (STATUS_RWRAW_ENCRYPTED_FILE_NOT_ENCRYPTED) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: STATUS_RWRAW_ENCRYPTED_FILE_NOT_ENCRYPTED a read or write of raw encrypted data cannot be performed because the file is not encrypted.

Previous	Next
STATUS_APPX_FILE_NOT_ENCRYPTED	STATUS_RWRAW_ENCRYPTED_INVALID_EDATAINFO_FILEOFFSET

STATUS_RWRAW_ENCRYPTED_FILE_NOT_ENCRYPTED

Raw EFS I/O is not an alternative way to copy plaintext files

STATUS_RWRAW_ENCRYPTED_FILE_NOT_ENCRYPTED identifies the raw encrypted-data path specifically. Microsoft documents OpenEncryptedFileRaw, ReadEncryptedFileRaw, and WriteEncryptedFileRaw for backup or restore that preserves an EFS-encrypted file in its encrypted state. The raw stream includes encrypted data and EFS information expected by that workflow.

If the source file is not encrypted, the backup engine should use its ordinary file-copy path rather than forcing the raw EFS path. The error is not corrected by granting backup privilege: privilege can allow an EFS-aware backup process to export encrypted data without the decryption key, but it does not turn a plaintext file into an encrypted one.

Audit the branch that selected raw mode. Mixed trees commonly contain both encrypted and unencrypted files, so the decision needs to be made per file and preserved through retries or resume logic.

What to inspect

The source file encryption state at the moment OpenEncryptedFileRaw or equivalent lower-level processing begins.
The mode flags used for export versus import and the code that selects raw EFS handling.
Whether retry or resume logic reused an encrypted-file context for a different plaintext file.

References

Looking for a different code? Search another status or error code.