How to decrypt EFS files, with key, that win7 thinks are unencrypted


  1. Posts : 8
    W7U 32b
       #1

    How to decrypt EFS files, with key, that win7 thinks are unencrypted


    Hi Folks,
    Problem as per title.
    I got here as follows:
    1) fatal hardware disk crash, killing part of one partition.
    2) Acronis disk image of the partition remnants to freeze conditiion (mostly good files)
    3) Unloaded image onto sound hard disk. Plan was to get good + bad files onto a stable disk.

    What I actually got was a raw disk. So I ran GetDataBack to see what was there, and it does contain a bunch of my files. However, I can't open them, because the originals were encrypted with EFS. I have the keys. I have the original laptop up and running on a new disk. I can get to all the encrypted files on the new disk.

    But GetDataBack just did a raw file recovery, so I have the files, sized, extensions and name. However, windows sees them as unencrypted, and thus won't decrypt them.
    cipher /d won't touch them either.
    So I need a means to force the Encrypted flag, without actually (double) encrypting the files.

    Any suggestions?
    Thanks!
      My Computer


  2. Posts : 1,784
    Linux Mint 18.2 xfce 64-bit (VMWare host) / Windows 8.1 Pro 32-bit (VMWare guest)
       #2

    Perhaps you could install the disk containing the files in a different computer, as the secondary drive. Since you would be running a good install of Windows on a good disk, you might be able to unencrypt them.

    Do you log in with a Microsoft account or a local account? If you log in to Windows with a Microsoft account, then maybe the needed user information will be available on the computer you try this on, because the encryption is tied to the user account.

    Here is some helpful information:
    https://www.howtogeek.com/236719/wha...em-on-windows/
      My Computer


  3. Posts : 8
    W7U 32b
    Thread Starter
       #3

    Thanks, but I have access to the files. I can see them; I can send them to a text reader, and see the content. I can do this locally, or an external drive. But because they are encrypted, I can't decode the content: it's just 'random' ASCII. I'm the owner, they are in my key, and I also have the recovery agent key. I can still decrypt and encrypt files from other partitions. But because Windows doesn't see the recovered files as encrypted, it doesn't try to decrypt them.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 02:51.
Find Us