1

Hi Everyone,

Long story short, windows update stopped the computer from booting, so new HDD and reinstall. Half of the old data is encrypted via EFS on windows 10 pro. Where / how can I find the key (user does not have a backup of it)

I have access to all the old files, windows folders etc as the drive is plugged into the same PC

Thanks in advance!

5 Spice ups
2

That’s kind of the whole point… If you don’t have the certificate, you can’t decrypt it. If the user did not back up their certificate, they have essentially lost that data.

5 Spice ups
3

if you don’t have a backup of your EFS key, your documents are gone forever.

sorry, but if there was some sort of backdoor into EFS there just would be no point in using it.

3 Spice ups
4

You need the key / certificate, otherwise you can not restore it.

That’s like losing the only key to a vault.Oops.

1 Spice up
5

If someone had forgotten the combination to a safe, in theory you could get a safe cracker to break into it, the difficulty goes up or down depending on the model and the materials.

With digital, it is nigh impossible to beat encryption unless there is a flaw in the method or known exploit. (tapping into the memory of a live system, etc)

You are on a worst case scenario with this. The data is gone for good, If you had a very large bounty reward for that data then maybe a security company might take you up on that and try breaking in, as it is, the best solution is a backup plan.

1 Spice up
6

Hi there, this is a users documents data.

There is possibly a way that i could fix the windows installation i could then recover the key.

If i did a repair of windows would the key still be there when i got into it?

7

Yes repairing the windows installation is the way to go if you want to get those files back.

1 Spice up
8

You would have to repair all of the system files on the windows computer in order to boot and then you would be able to (in theory) be able to recover the documents.

9

why? why is the encryption key for those files stored on the same volume the encrypted files are?

10

how? OP has the files but doesn’t have the key.

11

did you have a recovery policy set for your EFS?
are you even on a domain, or is this a workgroup?