±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 4 Overall: 35251
New Yesterday: 3 Visitors: 122

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

EFS File Encryption

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts


EFS File Encryption

Post Posted: Jul 11, 18 11:46

Have a hard drive where the suspect used EFS file encryption for numerous folders and files. Operating system is Windows 10 and I have the user's password. What is the easiest way to recover the encrypted files? I do not have access to Encase which I know supports EFS.  


Re: EFS File Encryption

Post Posted: Jul 12, 18 07:36

Advanced EFS Data Recovery can do that:


Senior Member

Re: EFS File Encryption

Post Posted: Jul 12, 18 11:53

Good ol' manual way (to be seen if needs to be adapted for more recent OS):
It did work just fine on a Windows 10 machine (with EFS coming from an old XP install):
which should mean that the methods detailed still work.

- In theory there is no difference between theory and practice, but in practice there is. - 

Page 1 of 1