A friend of mine gave me physical hard disc that contained some files in
My documents that were deleted (by
Move to Trash -> then
Empty Trash) and wanted me to recover them if possible.
I've plug in drive via external USB-to-SATA converter and run
Recuva on it. It found a lot of encrypted files in user profile directory, along with some non-encrypted that were deleted from other locations (like
C:\). I asked my friend, but she claims she never encrypted drive, so I believe this is just User Profile directory being encrypted by Windows.
I don't have access to previous PC, it was already sold out. What I want to do now is to run
sysprep-like tool to wipe motherboard drivers, then plug-in and launch OS directly from drive on my PC. This present the risk of data being overwritten, but it was deemed acceptable by the friend. The question is: after I log in into her account on OS, will
Recuva be able to restore user profile files? It should have access to encryption keys defined in user profile, should it not?
Is there any other way to recover files? The files are not that important to involve external recovery company, as recovery cost would vastly exceed gain.