A friend of mine gave me physical hard disc that contained some files in My documents that were deleted (by Move to Trash -> then Empty Trash) and wanted me to recover them if possible.

I've plug in drive via external USB-to-SATA converter and run Recuva on it. It found a lot of encrypted files in user profile directory, along with some non-encrypted that were deleted from other locations (like C:\). I asked my friend, but she claims she never encrypted drive, so I believe this is just User Profile directory being encrypted by Windows.

I don't have access to previous PC, it was already sold out. What I want to do now is to run sysprep-like tool to wipe motherboard drivers, then plug-in and launch OS directly from drive on my PC. This present the risk of data being overwritten, but it was deemed acceptable by the friend. The question is: after I log in into her account on OS, will Recuva be able to restore user profile files? It should have access to encryption keys defined in user profile, should it not?

Is there any other way to recover files? The files are not that important to involve external recovery company, as recovery cost would vastly exceed gain.

  • If you don't have access to the private key. What you want is not possible. The files are encrypted because EFS was being used. – Ramhound Sep 18 '16 at 5:10
  • @Ramhound Where the private key is located? – PiotrK Sep 18 '16 at 5:30
  • If the user backed it up, they would know, if they don't know it likely wasn't backed up. You understand sysprep does make changes right, it basically installs the OS, so data will be overwritten. – Ramhound Sep 18 '16 at 5:43
  • @Ramhound The valid OS is still present, I just don't have means to boot it since there will be serious hardware mismatch. Is there a way to retrieve the private key? – PiotrK Sep 18 '16 at 6:56
  • 1
    1) Don't use sysprep. 2) Read this: technet.microsoft.com/en-us/library/… 3) Always make a full binary image of a drive when trying to recover data from it, before doing ANYTHING else. 4) At least try booting it with the hardware mismatch, Windows is pretty good at dealing with it these days. As long as it's Intel -> Intel or AMD -> AMD it should work - I've moved a drive out of a 2008 X58 desktop into a 2011 QM67 laptop and then 2016 Z170 Intel desktop board - booted first time every time. – qasdfdsaq Sep 18 '16 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.