Windows 10: Can't decrypt encrypted files after re-installing windows despite import of backed up EFS...

Hi,I recently re-installed Windows 10 and made sure to backup all my personal files.However, with the original user account, many of these files were encrypted using the built-in Windows encryption mechanism. Knowing that it is important to backup the EFS encryption certificate, I made sure to safe it as pfx file elsewhere.Now, I am trying to get access to these files again, but despite importing the pfx I can not open any of the encrypted files.Under General -> Advanced in the file properties, I can see that the file is encrypted, and when clicking on Details I can see the name of the orig

:)

 

decrypting efs file

I assume that you never created a backup key or recovery agent as would have been suggested when you first started using EFS.

The way that Elcomsoft and other data recovery experts attempt to recover encrypted files is to search through the system's hard drive for information that they can use to recreate the decryption key. If you threw away the laptop and its system drive and
all you have now is the encrypted file itself, you're out of luck.

From Elcomsoft's explanation (Advanced EFS Data Recovery | Elcomsoft Co.Ltd.):

You can always email or call Elcomsoft or one of the other data recovery firms, but I would expect them to tell you the same thing.

 

How to decrypt/recover files that were corrupted during the EFS encryption?

During the encryption of file using EFS, the user cancelled the encryption process resulting EFS to stop midway during the encryption. Now, the user is unable to decrypt the file using his user account and recovery agent. Is there another way to decrypt/recover
the file?

 

EFS encryption

Hi, my name is Kelly, and I'm an independent consultant and I'm here to help.

I'm sorry to hear that you're having trouble accessing your encrypted files after your motherboard died. Here are a few things you can try to regain access to your files:

Try logging in with the same user account: If you can still access the Windows installation on the original hard drive, try logging in with the same user account that was used to encrypt the files. This may allow you to access the encrypted files.

Use your EFS recovery agent: If you set up an EFS recovery agent when you encrypted the files, you may be able to use it to access the encrypted files. Check your EFS recovery agent certificate to see if you can use it to decrypt the files.

Decrypt the files using a backup of your EFS certificate: If you have a backup of your EFS certificate, you may be able to use it to decrypt the files. To do this, you'll need to import the EFS certificate into the certificate store of the computer you're using to access the encrypted files.

Contact a data recovery specialist: If you're unable to access your encrypted files using the above methods, you may need to contact a data recovery specialist who has experience with EFS encryption. They may be able to help you recover your encrypted files.

Note that EFS encryption is tied to the user account that encrypted the files and the specific hardware that was used to perform the encryption. If you're unable to access the encrypted files using any of the above methods, it may not be possible to recover them.