From within Windows 10, Recover XP user certificate to unlock EFS

Question

I got a private home user that somehow??? accidentally encrypted his files with EFS. He was using windows XP and was unaware that the files were encrypted because his user account obviously had no problem accessing the files. His XP had trouble booting and he ask me to do an upgrade to windows 10...

Because of the haphazard file structure we decided to leave the drive as is and install windows 10 without changing the original file structure.

After we discovered we could no longer access my documents, I tried running a XP repair, Taking ownership, setting permissions to everyone, enabled inheritance and sharing the folder all of which failed.

The original account used to encrypt the files is still present on the drive, is there a way to extract the certificate form the old XP registry and import it to windows 10's active user? (This pc was never part of a domain)

Answer 1

If you have a fully functioning windows xp system, see if you can do the following:

• use cipher to create a data recovery account
• use certmgr.msc to export all the EFS and DRA keys and certs

Then try importing all that into the Win10 system and see if you can decrypt some/all of the files. If the user was very sloppy, they encrypted files with several different keys over the years...and that can be quite a mess to unscramble.