EFS Decryption Guide: How to Recover Encrypted Files on NTFS Drive

Jean updated on Sep 05, 2019 to Storage Media Recovery | How-to Articles

Summary

Learn from this EFS decryption guide to recover encrypted files on a Windows NTFS hard drive, USB flash drive or SD card without a hassle. In case you deleted files from the EFS hard drive or formatted it, download EaseUS Data Recovery Wizard for encrypted data recovery.

About Encrypting File System (EFS)

Encrypting File System (EFS) provides the core file encryption technology to protect critical and sensitive files on NTFS file system volumes with a certificate or key. Adopting EFS means that unauthorized users need to ask permissions when accessing files and folders. Otherwise, Microsoft Windows will deny access to the locked data. If you move the EFS encrypted hard drive to another computer, you can not access files on the device encrypted with EFS, either.

EFS is one of the multiple ways to encrypt individual files and folders in Windows. Here, we focus on discussing the possibilities of unlocking EFS encrypted files only. Visitors who are looking for solutions to decrypt BitLocker files or recover encrypted files by ransomware should go to the linked pages.

How to Open EFS Encrypted File

Usually, there are two groups of people requesting EFS decryption. One is with the password, while the other is without the password due to own mistake or key corruption.

1. Use the password

The EFS encrypted files have a lock displayed on the icon. To unlock these files, all you need to do is to log into your computer using the password.

2. Without Using the password

Forgetting the password is the case, or sometimes it's because the encryption keys are corrupt by a hard drive error. This time use the File Properties to decrypt EFS files.

Step 1. Press Windows + E to open file explorer. Right-click on the file and select Properties.

Step 2. Switch to the Security tab, and click Advanced.

Step 3. Clear the Encrypt Contents to Secure Data check box.

How to Recover Deleted EFS Encrypted Files

Due to some careless operation on the encrypted files by the owner, such as deletion, disk formatting, or virus infection, the encrypted files disappeared without expectation. If it's to recover the lost EFS encrypted files, you need to download EaseUS Data Recovery Wizard to recover encrypted files on a Windows NTFS hard drive, USB flash drive or SD card without a hassle.

The efficient and easy-to-use EFS Recovery Tool offers you a simple encrypted file recovery solution to recover encrypted files from NTFS drive and external hard drive. But the prediction is that the encryption password must be known or SAM database must be present (Windows 2000, XP, 2003, Vista, 2008, Windows 7, 8). The user must have administrator privileges. The green "sample2.txt" is an encrypted file of NTFS drive.

Recover Encrypted file/folder on NTFS Drive

STEP 1. Select the location

Launch EaseUS data recovery software, select the lost NTFS partition and click "Scan" to look for all the lost and existing files on this NTFS partition.

find the NTFS partition

STEP 2. Scan the NTFS drive or partition

After clicking the "Scan" button, the software will be able to scan the NTFS partition on its own. Just wait patiently until the scanning process ends.

scan the NTFS partition

STEP 3. Recover data from NTFS drive

After the scan, choose the lost data and click the "Recover" button to get them back from the NTFS partition.
(Please Note: DO NOT save the files to the NTFS partition where you lost the data.)

Note:

  • It does not work with FAT partitions. All recovered encrypted files must be copied to NTFS partition.
  • It must work on the present Windows system.
  • The recovered files are still encrypted.
 
 

100% of people found this article helpful.

 

Frequently Asked Questions

1. Why cannot I recover 2GB data for free?

It is recommended to check the version installed is Free or Trial because they are different versions.

Trial has data preview function but cannot save any files, while the Free version enables to recover 2 GB files. The default free space is 500 MB and you may share the product on social media to get another 1.5 GB.

2. Why cannot the recovered files be opened?

A file is saved as 2 parts on the storage device: directory info (which is comprised by file name, time stamp and size info, etc.) and data content.

If the files with original file names and folder structures cannot be opened, one possible reason is the corrupted directory info. There is still a chance to recover the data content with the RAW Recovery method in our software.

3. Why isn't it suggested to recover the files back to the original drive?

The storage structure of the lost files would be altered or damaged by any changes on the drive. If you save the recovered files back to the same drive, the original data structures and data content would be corrupted or overwritten, which causes permanent data loss. So you should prepare another disk to save the files.

4. How can I check whether my data is recoverable or not before purchase?

The Free version helps you save 2GB files to better verify the recovery quality of our product before purchase.

5. How long does it take to scan the drive?

It strongly depends on the capacity of your hard drive and the performance of your computer. As reference,most drive recoveries can be completed in around 10 to 12 hours for a 1-TB healthy hard drive in general conditions.

About Data Recovery Wizard

It's super easy to recover 250+ types of files after deletion, disk formatting and virus infection. Click the links and compare the difference of each version.