I am trying to recover from this hard drive. the drive is seen in the bios and is seen in bartpe, it can even see the drive label; but can't recognize the drives filesystem and prompts me to format it.

After recoverering the files to a network share I get the following error message written inplace of the file:

Unable to reconstruct the encrypted file - Unable to open encrypted file, EFS API failure code126

Why would the files be encrypted? is there any chance of recovering them?

TYIA
Ariel

Product you are using: irecover

Operating system / Service Pack: windows xp / bartpe

Size of subject harddisk: 20gb

Hello,

"After recoverering the files to a network share"

How were the files recovered?

"Unable to reconstruct the encrypted file - Unable to open encrypted file, EFS API failure code126"

And this is after the files were copied right? So it's a Windows message and not a message from the recovery tool you are using?

I Googled for it, no hits with the particular error, I have never heard of it before.

"Why would the files be encrypted? is there any chance of recovering them"

Why the files were encrypted I can not tell. I assume the volume was formatted NTFS and encryption was ebabled (files would have been 'green' in the explorer. Can you remember that?)

Assuming the files were on an NTFS volume, what was the format of the drive you copied them to? If not NTFS, I'd try copying them to an NTFS drive.

If you use recovery software like iRecover, encrypted files will remain encrypted after you have copied them. In other words, file recovery software is a not a way of hacking your way into encrypted files.

To open encrypted files, you will need the assiociated key. Also, the files need to be on an NTFS partition as FAT or FAT32 does not support encryption at the file system level.

It appears Elmsoft (http://www.elcomsoft.com/aefsdr.html) offers tools to de-encrypt NTFS encrypted files. I have no experience with this software.

--
Kind regards,
Joep