RedditPP Mascot

RedditPP

r/techsupport • … • u/TheFotty

Issue with files/folder encryption using EFS

While attempting to clone a drive, we ran into an issue after turning off bitlocker.

Bitlocker was turned off, and the machine fully decrypted the drive. Then it was shut down, and drive was removed and connected to a different machine to clone the drive. Somehow after bitlocker decryption was done, the main partition of the drive now just showed as RAW. Since it was time sensitive, we opted to just do a clean install of Windows on the new bigger drive, as we were told all the important information was in cloud storage. After this was done and the machine was given back, I was able to run a chkdsk on the original drive which took a while, corrected errors, but then the drive was showing NTFS and was readable when connected to another windows machine. We then were asked for a folder that was on the root of C that wasn't part of the cloud storage. However, the files JUST in this specific folder look like they were encrypted with EFS, as only the contents of this one folder have a padlock icon on all the files and in advanced file properties, the "encrypt contents to secure data" checkbox is checked.

None of these files can be opened and I am going to assume there isn't a way to decrypt them without some key or certificate file. The question is, is this key still stored somewhere on the drive I still have that I can get access to? I can't add the machine's user profile that the drive is currently connected to for the permissions of the encryption (the drive is connected to a working machine as a secondary drive, not booted to it). I currently don't know if the drive would even be bootable anymore, and even if it was, I don't know if it would need to be put back into the same exact machine for decryption to work or not. Any thoughts?

— 0