EFS: decrypt PFILE RRS feed

  • Question

  • How do I decrypt PFILEs?

    Unintentionally I have copied my EFS encrypted files from my Win10 workstation onto USB stick which was formatted as FAT32 as I found out later. I was in a hurry and ejected USB stick by force. Now all files have appended PFILE extension (e.g. document.doc.PFILE). Windows finds them unencrypted (GUI says that also cipher /d), but there's a header in each file which clearly says it is EFS encrypted.

    d:\>cipher /d ilo.xlsx
     Decrypting files in d:\
    0 file(s) [or directorie(s)] within 1 directorie(s) were decrypted.

    d:\>strings ilo.xlsx | more

    Strings v2.51 Copyright (C) 1999-2013 Mark Russinovich Sysinternals - cA' ^#0 9jdS le-EFS-ed7747e0-3462-442d-8a77-9b64d1f73fa0 Microsoft Enhanced Cryptographic Provider v1.0

    • Edited by marianh Thursday, July 28, 2016 9:50 AM
    Tuesday, July 26, 2016 11:00 AM

All replies