Windows 10: Possible to recover EFS Key from formatted Windows installation?

I know this is a long shot but...

I had to reinstall Windows on my SSD. Then discovered I have work on another disk encrypted using Window's normal EFS. Since it might be possible to recover some files from the old Windows installation, is there any way I could somehow recover the key(s)?

Thanks.

:)

 

Can I recover encrypted files with EFS without having key.pfx file ?

There is no solution available without the encryption key.

Might you be able to run
Recuva or similar on the old drive to undelete the old key [there is some information about its location in

http://www.tomshardware.co.uk/forum/278973-45-decryption-encrypted-file]? If you can get at the old key then the procedure used here should be able to help you -

How to open EFS encrypted files on an HDD that came from Windows XP

Without the key you are not going to recover those files. EFS is too good for that.

Denis

 

Need guidance on decrypting Windows-encrypted files after upgrading from Windows 7 to Windows 10

UPDATE: It appears that the files of interest were automatically encrypted using
Windows EFS. I went through the process of trying to recover the missing course files again, using 3rd party software. When I did a search to recover the original folder the tool returned a list of files to individually select, each of which
was listed in this format:

Drive...\foldername:$EFS:$LOGGED_UTILITY_STREAM\....filename

I believe that this is entirely something different from BitLocker.

With this in mind, does anyone have some new suggestions?

Thanks,

-DS

 

Welcome to TenForums @vinhos3,

If you still have the Windows.old can't you just roll back to your previous version for a while? Or was it so badly damaged that you can't use it, even in Safe Mode?

 

I formatted the SSD first, so no Window.old. But I could recover individual files easily with a data recovery program.

 

And, how will the data recovery program be able to de-encrypt each recovered file?

 

I'm not sure, but I think the certificate needs to be "exported" and then "imported", so you may be out of luck.

 

Hey,

I have the same problem like you.My data on the external hard drive is encrypted.
PC disk drive was fos formated and the reinstalled windows has a new id etc...
Did you find a way how to decrypt the data without the certificate ?
Or any other solutions...

 

Whole point of encryption is to prevent people doing what you ask!

There may be dodgy or even outright illegal methods to do this but we are not permitted to discuss such things on this forum.

 

Sorry and yes you're right.I did not express myself well.Just wanted to know if there is a way how to get the certificate.But it doesnt seems like that and my data is gone :/

 

The problem with encryption is some important feature is saved in the Registry, reinstalling Windows can write a new Registry causing problems. The Registry is made up of 5 text files called Hives, problems in any one of them can have dire consequences.