Data Recovery on potential Windows EFS files

[boogerhookmcgee]

I woke up yesterday and all of my media (pictures, videos, music, etc.) that I had stored on a secondary drive had just disappeared. I was able to retrieve the majority of the data via recovery software but now I am unable to open any of the files that were recovered. Whenever I attempt to open a file it tells me that the filetype is not supported, even though all the files are in common file types such as .jpg,.png,.gif, etc.. I have tried multiple different programs not only to open the files but also to retrieve them from the disk, so far with no luck. After a round of googling I found that it could potentially be because the files were originally encrypted through Windows EFS. I have no recollection of doing so but certmgr shows an encryption key generated for my profile. The issue is none of the recovered files are marked as being encrypted and attempting to re-encrypt and decrypt does nothing to the original file. Is my data recoverable somehow? Has it been corrupted beyond saving? Any help would be greatly appreciated.

[lcoughey]

Did you save to a different hard drive or to the source drive?

[boogerhookmcgee]

I saved it to a different drive as I didn't want to risk overwriting any data in case it failed.

[lcoughey]

It is possible that the files truly are encrypted and it could be something else.

What software are you using?
Were there any read errors?

[boogerhookmcgee]

I have used EaseUS, Recuva, Undelete360, and TestDisk for recovery. Each case ends with the same result. No read errors to speak of with the exception of files that had already been overridden.

[lcoughey]

Okay...that is likely part of the problem. I suggest trying some actual recovery programs.

R-Studio
UFS Explorer

If you don't have any luck, we could create a ticket (https://www.recoveryforce.com/start/) and arrange a remote recovery session on Tuesday.

[boogerhookmcgee]

I'll give them a shot thanks

[boogerhookmcgee]

After letting both run over night I was able to retrieve my files but each one has a corresponding .$efs file partnered with it. I guess that means the files are encrypted. I have no experience with encryption so I'm at a total loss here. Is there a way to decrypt them? Or am I just out of luck and stuck with a bunch indecipherable data?

[lcoughey]

It is odd as the file encryption should still be linked to the primary OS that holds the encryption key. Did you do anything with the OS (boot drive) just prior to everything going stupid?

...and sorry for the delayed response. Our website decided to go stupid shortly after you posted your last comment and I just got it corrected this morning.

[Joep]

After letting both run over night I was able to retrieve my files but each one has a corresponding .$efs file partnered with it. I guess that means the files are encrypted. I have no experience with encryption so I'm at a total loss here. Is there a way to decrypt them? Or am I just out of luck and stuck with a bunch indecipherable data?

Where did you save files to, what file system? Is this on same PC as files were originally encrypted on?