Scan for encrypted files

 

<< Click to Display Table of Contents >>

Navigation:  System and Data Recovery Programs > Advanced EFS Data Recovery > Working with AEFSDR >

 

Scan for encrypted files

 

Once the keys have been found and decrypted, you're ready to decrypt the files. If you already know which files are encrypted and where they're located, skip this step and go directly to Browse for encrypted files.

 

Otherwise, switch to the Encrypted files tab in AEFSDR. There, press the Scan for encrypted files button (or select Scan | Scan for encrypted files from the menu; or press the Scan for encrypted files button on the toolbar). The program will prompt you to select the disk(s) to scan for encrypted files in about the same way as when you scanned the disk for encryption keys. Only NTFS disks will be listed there as Encrypting File System is only available on NTFS volumes.

 

Select disks you want to scan, and press the Start Scan button. Note that if selected disks are large and contain a large number of files, this process may take several minutes or even hours. Once the program finds encrypted files, it immediately adds them to the list. At the end of the scanning, you should receive the complete list of encrypted files containing the file name (with full path), size in bytes, and modification date.

 

files

 

The last column (User) reads as follows:

 

John Doe, RA: Ivan Ivanov

 

First name ("John Doe" in this example) is the name of the user who encrypted the file. Names following the RA: token are Recovery Agents ("Ivan Ivanov"), if exist.

 

The files in this list will be highlighted with either green or red depending on whether the file can be decrypted or not. If the required files cannot be decrypted, you have to scan for encryption keys again (e.g. scanning another partition; and/or adding SYSKEY or user passwords). For files encrypted in Windows XP, you always have to add user passwords; otherwise, the keys (and so the files) cannot be decrypted at all.

 

When all encrypted files have been found, you can decrypt them.