I have some files that are encrypted with EFS. I do not have the certificate to decrypt. But I do know the username, computer name, password, etc. that were used when the files were created. Is there a way to recover the files?

  • If yes, how?
  • If not, what other information does windows use to create the certificate.

EDIT (some additional information after the first few answers): So, I have a corrupted windows hard drive that doesn't boot anymore. But I can access essentially all files when I connect it as an external hard drive. So, my thinking is, that if I can extract the certificate (which is protected by the user-password [?] that i know) from the registry. I could maybe access the corresponding files ...

  • Without the certificate the files cannot be decrypted. You cannot just simply "recreate" the certificate. There is no work around to your problem if you don't have a copy of the original certificate. – Ramhound Jun 22 '17 at 20:38

You can recreate a certificate, but only if you have the private key that it used. If you are going to do certificate-based disk encryption, you need to have a secure backup for your certificate and/or keys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.