How can I recover files encrypted with Windows filesystem encryption?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

I ran into a situation similar to this as well. My solution was to use a linux boot disk to copy the files from the encrypted drive. The only downfall was linux can read from an NTFS drive but not write to one. Not a big problem for me because my files were not that large and I was able to use a flash drive with FAT. May be a problem with this situation since the majority of the files are music and pictures!

Actually, newer Linux distributions can write to NTFS. (I did so just last week.)

However, I don't see how Linux could read the encrypted filesystem. (Or is the filesystem not encrypted, and only the files themselves are? In which case, all you can do is read the raw, encrypted data from the files.) Linux can't decrypt the data without the key any more than Windows can.

"Have your boyfriend or a technician check out the Microsoft information "

My goodness Leo, I am normally not sensitive about such things, but this certainly seems to be a sexist comment. Why does one have to be male to understand Microsoft information? Is it written in a secret(male)language?

On the whole, I enjoy your site and find it informative and interesting.

Judith,

He suggested she ask her boyfriend because in her letter she wrote if this involved
"programming skills" she would ask her boyfriend because he "knows about that stuff". Whether she's speaking of programming languages or normal computer tech skills who knows.

Actually I have encounted the same problems before. I use the knowledge from NT Server 4 to perform on the Windows XP Pro with the old system drive as the slave. You only have to reassign the encrypted files rights back to the system. Once the files are own by the system, create a new user and reassign all the files right to that new user. Login as that new user and you are already accessing your files!

There is a method that you did not even suggest and it is so simple that you would freak. True security on any computer is very difficult too acheive (not imposible) You can talk to the security experts to find out how simple it is.
I do this on a regular basis and I do not want to give it away.

I have encrypted my file and after that i changed my operating system.After that when i try to open my encrypted file,it didn't open.Said "Access is Denied".You have no Permission,I have tryed so much but i cant open the file.
Please I request to u Tell me some idea from which i could access my file. Bye..........

I had the same situation, I had encrypted a folder containing more than 3GB data and when last week I restored my system drive from an image file, I found myself in a real nightmare: I could not able to access my old data! f..k you Microsoft, I told many times, after many hours searching, I come up with a great tools called Advanced EFS data Recovery, it saved my life. Its last edition can found any private key (you need them) from disk clusters (where that your last windows still stayed there) and decrypt your folders. It is very strightforward.

I just attempted to copy encrypted folders (and contents) to an NTFS USB drive using an Ubuntu Live CD. It would NOT copy the files. I will re-test with a FAT32 USB drive and see what happens. Ubuntu is of course a Linux based OS.

Oliver Galea said in his post that recovering encrypted files is "so simple you would freak". Perhaps he is referring to this method of freezing the DRAM chips with liquid nitrogen?
http://www.disco-tech.org/2008/02/stealing_encrypted_data.html

To post a comment on "How can I recover files encrypted with Windows filesystem encryption?", please return to that article's main page.