EFS protected files

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
pkesseli
Posts: 1
Joined: 08 Mar 2023, 17:10

EFS protected files

#1 Post by pkesseli »

Hi everyone,

I recovered files from a broken partition using testdisk, but EFS protected files are all empty after copying.
I still have the private key and could open them if they were extracted, but they all end up being empty. Is there a way to recover such files with testdisk as well?

Thank you,

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: EFS protected files

#2 Post by cgrenier »

There is no code to deal with EFS protected files in TestDisk.
Reading https://github.com/gentilkiwi/mimikatz/ ... -EFS-files it looks awfully complex to deal with such files.

Locked