cgsecurity.org

Hi everyone,

I recovered files from a broken partition using testdisk, but EFS protected files are all empty after copying.
I still have the private key and could open them if they were extracted, but they all end up being empty. Is there a way to recover such files with testdisk as well?

Thank you,

There is no code to deal with EFS protected files in TestDisk.
Reading https://github.com/gentilkiwi/mimikatz/ ... -EFS-files it looks awfully complex to deal with such files.