Various techniques, including a method, system and computer program product for restoring encrypted files are disclosed. The method includes accessing a file table record for an encrypted file. The file table record includes an encrypted file stream and extent information identifying a location of one or more portions of the encrypted file in a virtual machine image. In response to accessing the file table record a consecutive data stream is stored. Storing the consecutive data stream includes encapsulating the encrypted file stream and the one or more portions of the encrypted file.