Today my harddrive had some kind of mid-life crisis and got itself in a state that no amount of dskchking or "Startup Recovery"ing could resolve, so I attached another disk, installed windows on that and recovered the files from the old disk, all well and good.

The problem is there's one directory I had encrypted, and of course the contents of the recovered files are gibberish. Is it possible, since I have full access to the disk, and know the account password it was encrypted with, I may still be able to decrypt it somehow?

Edit: I do not have explicit backups of the keys, I am hoping that Windows stores them somewhere by default.

link|improve this question
1  
If you backed up the key, yes. – David Schwartz Nov 16 '11 at 20:10
Updated post, don't have an explicit backup unfortunately. – connec Nov 16 '11 at 20:14
feedback

migrated from serverfault.com Nov 16 '11 at 20:16

This question came from our site for system administrators and desktop support professionals.

2 Answers

up vote 3 down vote accepted

In the end I used http://www.diskinternals.com/efs-recovery/ which was quick and painless: found the encrypted files/authentication data with a scan of the drive, requested password for the account, and decrypted the files.

I was even able to use the free version as it allows preview, and the files I was recovering were plain-text.

link|improve this answer
feedback

There may be a utility for this. I suspect the working version will cost you.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.