Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Today my harddrive had some kind of mid-life crisis and got itself in a state that no amount of dskchking or "Startup Recovery"ing could resolve, so I attached another disk, installed windows on that and recovered the files from the old disk, all well and good.

The problem is there's one directory I had encrypted, and of course the contents of the recovered files are gibberish. Is it possible, since I have full access to the disk, and know the account password it was encrypted with, I may still be able to decrypt it somehow?

Edit: I do not have explicit backups of the keys, I am hoping that Windows stores them somewhere by default.

share|improve this question

migrated from serverfault.com Nov 16 '11 at 20:16

This question came from our site for system and network administrators.

1  
If you backed up the key, yes. – David Schwartz Nov 16 '11 at 20:10
    
Updated post, don't have an explicit backup unfortunately. – connec Nov 16 '11 at 20:14
up vote 3 down vote accepted

In the end I used http://www.diskinternals.com/efs-recovery/ which was quick and painless: found the encrypted files/authentication data with a scan of the drive, requested password for the account, and decrypted the files.

I was even able to use the free version as it allows preview, and the files I was recovering were plain-text.

share|improve this answer

There may be a utility for this. I suspect the working version will cost you.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .