Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My laptop running vista x64 experienced hardware failure. The hard drive appears undamaged, and when I connect it to my win7 desktop, I can read all the files except the EFS encrypted user folder, which contains the data I would like to recover. No EFS certificate was ever backed up or exported from the vista volume. The vista install appears to be intact.

How can I access the files in the EFS partition, to copy them onto my win 7 machine (e.g., without booting into the old vista volume)? I know the vista user password, and the original EFS certificate should still be embedded in the Vista installation on the drive.

I'm aware of the Elcom recovery program, but I would rather not spend the $150 if I don't have to.

share|improve this question
1  
No encryption certificate, no data....windows.microsoft.com/en-US/windows-vista/… ... windows.microsoft.com/en-US/windows-vista/… –  Moab Jun 6 '11 at 4:41
    
@Moab: The certificate is still there in the user profile (and obviously not EFS-encrypted), one just has to find a way to extract it. –  grawity Jun 6 '11 at 21:17
1  
@grawity, I suppose that is what Elcom charges $150 for. –  Moab Jun 6 '11 at 21:48

1 Answer 1

Here's an article on manual recovery of EFS-encrypted files (which involves heavy amounts of registry, hex editing, and black magic). The page also lists two other commercial alternatives.

Booting into Vista would be much easier, at least to export the EFS certificate/key (through certmgr.msc); is there any reason you cannot do this?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.