How to decrypt EFS files, with key, that win7 thinks are unencrypted

[MikeE6410]

Hi Folks,
Problem as per title.
I got here as follows:
1) fatal hardware disk crash, killing part of one partition.
2) Acronis disk image of the partition remnants to freeze conditiion (mostly good files)
3) Unloaded image onto sound hard disk. Plan was to get good + bad files onto a stable disk.

What I actually got was a raw disk. So I ran GetDataBack to see what was there, and it does contain a bunch of my files. However, I can't open them, because the originals were encrypted with EFS. I have the keys. I have the original laptop up and running on a new disk. I can get to all the encrypted files on the new disk.

But GetDataBack just did a raw file recovery, so I have the files, sized, extensions and name. However, windows sees them as unencrypted, and thus won't decrypt them.
cipher /d won't touch them either.
So I need a means to force the Encrypted flag, without actually (double) encrypting the files.

Any suggestions?
Thanks!

 

[mrjimphelps]

Perhaps you could install the disk containing the files in a different computer, as the secondary drive. Since you would be running a good install of Windows on a good disk, you might be able to unencrypt them.

Do you log in with a Microsoft account or a local account? If you log in to Windows with a Microsoft account, then maybe the needed user information will be available on the computer you try this on, because the encryption is tied to the user account.

Here is some helpful information:
https://www.howtogeek.com/236719/wh...er-and-efs-encrypting-file-system-on-windows/

 

[MikeE6410]

Thanks, but I have access to the files. I can see them; I can send them to a text reader, and see the content. I can do this locally, or an external drive. But because they are encrypted, I can't decode the content: it's just 'random' ASCII. I'm the owner, they are in my key, and I also have the recovery agent key. I can still decrypt and encrypt files from other partitions. But because Windows doesn't see the recovered files as encrypted, it doesn't try to decrypt them.