need help with decrypt file on external hard disk

[keny]

can someone help with file that already encrypt because i need to decrypt before moving to his/her computer

i recently have a customer that his/her file was shown as green name i didn't know that it was encrypted and i just backup as usual then i just format the computer so after i copying back the backup to the computer back only the encrypted one is cannot copy back to the computer now i don't know how to do already i try everything but not available if can plz someone help my problem

[tech.guru]

there is no way thats the point of encryption, before copying you should have decrypted .you cant not recover the files unless its in a domain environment where you can setup a recovery agent.

 

the local user certificate was lost used for encryption when you formated the pc.

the data is lost unless it was joined to the domain and a data recovery agent was setup prior to the format.

 

you can read more about efs online..

[tech.guru]

you may have luck trying to recover files from the formatted partition using testdisk. your goal would be to try and recover the efs certificate and private key

 

it would be difficult,

the locations for user private keys are

%APPDATA%\Microsoft\SystemCertificates\My\Certificates
%USERPROFILE%\AppData\Roaming\Microsoft\Crypto\RSA\SID
%USERPROFILE%\AppData\Roaming\Microsoft\Credentials
%USERPROFILE%\AppData\Roaming\Microsoft\Protect\SID

the certificates would be here

HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates

 

you would need load the NTUSER,DAT to try and recover that key. I have no idea if this would work or if Microsoft encrypts the files for the private keys or ties the certificate to the old account sid.

 

you would copy the files and registry to the new computer and see if copying the files and registry installed the certificate necessary to decrypt the data.

[keny]

NTUSER.dat need at the old system or the already formatted one

[keny]

seems that the customer is already arrive to pick his/her computer so i can't use their original disk so i had to jailbreak it 

[tech.guru]

the only way would be to try and recover that data i list above off the formatted drive.

[keny]

ya now the customer got his/her computer so i can't do it anymore