Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My laptop running vista x64 experienced hardware failure. The hard drive appears undamaged, and when I connect it to my win7 desktop, I can read all the files except the EFS encrypted user folder, which contains the data I would like to recover. No EFS certificate was ever backed up or exported from the vista volume. The vista install appears to be intact.

How can I access the files in the EFS partition, to copy them onto my win 7 machine (e.g., without booting into the old vista volume)? I know the vista user password, and the original EFS certificate should still be embedded in the Vista installation on the drive.

I'm aware of the Elcom recovery program, but I would rather not spend the $150 if I don't have to.

share|improve this question
No encryption certificate, no… ...… – Moab Jun 6 '11 at 4:41
@Moab: The certificate is still there in the user profile (and obviously not EFS-encrypted), one just has to find a way to extract it. – grawity Jun 6 '11 at 21:17
@grawity, I suppose that is what Elcom charges $150 for. – Moab Jun 6 '11 at 21:48

Here's an article on manual recovery of EFS-encrypted files (which involves heavy amounts of registry, hex editing, and black magic). The page also lists two other commercial alternatives.

Booting into Vista would be much easier, at least to export the EFS certificate/key (through certmgr.msc); is there any reason you cannot do this?

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .