how to extract efs encrypted data with DE?

[BSIT]

how can i extract efs encrypted data with DE?

first, i imported efs key before use DE.

then, i tried data copy with DE, but can't extract efs encrypted files.

and beside can't copy secters of efs encrypted datas to destination disk.

is there any way to extract encrypted data with DE?

is there only way decrypt from copied disk?

i need a way extract necessary data with DE.

because of patient hdd has so many badsector, so need very long times for disk copy.

[ACE_Admin]

Dear BSIT.

Hello.

Unfortunately, Data Extractor does not know decryption methods. However we have different solutions for this.
Please provide full hard drive model you have faced and I will check what could we try with it.

There are solved cases for Helios and Zephyre Western digital usb hard drive families, very likely, your drive is one of these.
Waiting for your reply.

[BSIT]

Hi.

Unfortunately, this drive is not WD, it's fujitsu MHZ2160BJ.

utility not support this model wet.

So, i just wait disk copy finish use copy used sectors map(from bitmap).

thanks.

[Nick_TS]

Data Extractor doesn't allow to save encrypted files (because of it doesn't know where is key and how to decrypt these files).
Only way I see is to make whole copy of drive and insert destination drive into PC where these files were encrypted.

To decrypt these files we need key. Key is divided into two parts.
One part is located into 100h attribute of MFT record of this file.
Other part is located in PC registry on system drive. So for example if system drive is C:\ and encrypted files are on D:\ then files and part of decryption keys will be on different drives.

New DE allows to save encrypted files they are saved with part of key located in MFT record

We don't know where second part of key is located in registry. So DE can find only one part of key.
Better way is to clone whole drive and analyze it via special software to decrypt files.