Daten mit Powershell verschlüsseln

function Encrypt-File {
    [cmdletbinding(SupportsShouldProcess=$true)]
    param(
        [Parameter(mandatory=$true,ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)][ValidateNotNullOrEmpty()][ValidateScript({Test-Path $_})][Alias('FullName')][string[]]$path,  
        [Parameter(mandatory=$true)][ValidateNotNullOrEmpty()][string]$password,
        [Parameter(mandatory=$false)][ValidateNotNullOrEmpty()][string]$salt='jj3h4h5+tbbj2j281273#+',  
        [Parameter(mandatory=$false,HelpMessage='Overwrites original with zeros and finally deletes the file.')][ValidateNotNullOrEmpty()][switch]$shredoriginal,  
        [Parameter(mandatory=$false)][ValidateNotNullOrEmpty()][ValidateSet('Zeros','RandomData')][string]$shredmethod = 'Zeros',  
        [Parameter(mandatory=$false)][ValidateNotNullOrEmpty()][switch]$force
    )
    begin{
        $p = new-Object System.Security.Cryptography.AesManaged
        $p.Key = (new-Object Security.Cryptography.PasswordDeriveBytes ([Text.Encoding]::UTF8.GetBytes($password)), ([Text.Encoding]::UTF8.GetBytes($salt)), "SHA256", 5).GetBytes(32) #256/8  
	    $p.IV = (new-Object Security.Cryptography.SHA256Managed).ComputeHash([Text.Encoding]::UTF8.GetBytes($salt))[0..15]
        $encryptor = $p.CreateEncryptor()
        if ($shredoriginal.IsPresent){
            $shredcollection = New-Object System.Collections.ArrayList
        }
    }
    process{
        foreach($file in $path){
            $fsEncrypt = $null
            $csEncrypt = $null
            $fsRead = $null
            try{
                if ($pscmdlet.ShouldProcess($file, "Encrypt file")){  
                    $fileout = "$file.encrypt"  
                    if ((Test-Path $fileout) -and !$force.IsPresent){
                        throw "File '$fileout' already exists, to overwrite the file regardless if it exists, use the -force switch!"  
                    }
                    $fsEncrypt = New-Object System.IO.FileStream $fileout, "Create"  
                    $csEncrypt = New-Object Security.Cryptography.CryptoStream $fsEncrypt,$encryptor,"Write"  
                    $fsRead = New-Object System.IO.FileStream $path, "Open"  
                    $fsRead.CopyTo($csEncrypt)
                    $fsRead.Close()
                    $csEncrypt.Close()
                    $fsEncrypt.Close()
                    if ($shredoriginal.IsPresent){
                        [void]$shredcollection.Add($file)
                    }
                    return (gi $fileout)
                }
            }catch{
                Write-Error $_.Exception.Message
            }finally{
                if($fsEncrypt){$fsEncrypt.dispose()}
                if ($csDecrypt){$csDecrypt.Dispose()}
                if ($fsRead){$fsRead.Dispose()}
            }
        }
    }
    end{
        if ($shredoriginal.IsPresent){
            if ($pscmdlet.ShouldProcess('all above files','Shred files')){  
                $crypto = New-Object System.Security.Cryptography.RNGCryptoServiceProvider
                foreach ($file in $shredcollection){
                    $fs = $null
                    try{
                        $fs = New-Object System.IO.FileStream $file, ([System.IO.FileMode]::Open)
                        $data = $null
                        switch($shredmethod){
                            'Zeros' {  
                                $data = New-Object 'Byte' $fs.Length  
                            }
                            'RandomData' {  
                                $data = New-Object 'Byte' $fs.Length  
                                $crypto.GetBytes($data)
                            }
                        }
                        $fs.Write($data,0,$data.Length)
                        $fs.Close()
                        del $file -Force
                    }catch{
                        Write-Error $_.Exception.Message
                    }finally{
                        if ($fs){$fs.Dispose()}
                    }
                }
            }
        }
        $p.Clear()
    }
}

function Decrypt-File {
    [cmdletbinding(SupportsShouldProcess=$true)]
    param(
        [Parameter(mandatory=$true,ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)][ValidateNotNullOrEmpty()][ValidateScript({Test-Path $_})][Alias('FullName')][string[]]$path,  
        [Parameter(mandatory=$true)][ValidateNotNullOrEmpty()][string]$password,
        [Parameter(mandatory=$false)][ValidateNotNullOrEmpty()][string]$salt='jj3h4h5+tbbj2j281273#+',  
        [Parameter(mandatory=$false,HelpMessage='Deletes encrypted file after successfull decryption')][switch]$DeleteEncrypted,  
        [Parameter(mandatory=$false)][switch]$force

    )
    begin{
        $p = new-Object System.Security.Cryptography.AesManaged
        $p.Key = (new-Object Security.Cryptography.PasswordDeriveBytes ([Text.Encoding]::UTF8.GetBytes($password)), ([Text.Encoding]::UTF8.GetBytes($salt)), "SHA256", 5).GetBytes(32) #256/8  
	    $p.IV = (new-Object Security.Cryptography.SHA256Managed).ComputeHash( [Text.Encoding]::UTF8.GetBytes($salt) )[0..15]
        $decryptor = $p.CreateDecryptor()
    }
    process{
        $fsReadDecrypt = $null
        $fsWriteDecrypt = $null
        $csDecrypt = $null
        foreach ($file in $path){
            try{
                if ($pscmdlet.ShouldProcess($file, "Decrypt file")){  
                    $fileout = $file -replace '\.encrypt$'  
                    if ((Test-Path $fileout) -and !$force.IsPresent){
                        throw "File '$fileout' already exists, to overwrite the file regardless if it exists, use the -force switch!"  
                    }
                    $fsReadDecrypt = New-Object System.IO.FileStream $path, "Open"  
                    $fsWriteDecrypt = New-Object System.IO.FileStream $fileout, "Create"  
                    $csDecrypt = New-Object Security.Cryptography.CryptoStream $fsReadDecrypt,$decryptor,"Read"  
                    $csDecrypt.CopyTo($fsWriteDecrypt)
                    $csDecrypt.Close()
                    $fsReadDecrypt.Close()
                    $fsWriteDecrypt.Close()
                
                    if ($DeleteEncrypted.IsPresent){
                        del $file -Force
                    }
                    return (gi $fileout)
                }
            }catch [System.Security.Cryptography.CryptographicException] {
                Write-Error "Password is not incorrect." -Category InvalidArgument  
            }catch{
                Write-Error $_.Exception.Message
            }finally{
                if ($fsReadDecrypt){$fsReadDecrypt.Dispose()}
                if ($fsWriteDecrypt){$fsWriteDecrypt.Dispose()}
                if ($csDecrypt){$csDecrypt.Dispose()}
            }
        }
    }
    end{
        $p.Clear()
    }
}

# Encrypt some files
#ls 'D:\data' -File -Filter *.jpg | Encrypt-File -password 'Passw0rd' -force -shredoriginal  

# Decrypt some files
#ls 'D:\data' -File -Filter *.encrypt | Decrypt-File -password 'Passw0rd' -force