Corrupted Win10 Profile, and Can't Decrypt Files

Hey folks:

I've got two HDs; one which is for the OS, and one for files. (I run Macrium Reflect, but stupidly did not include the OS drive in that imaging.)

For some reason my Windows profile became corrupted.  While I still have all of my files on the second hard drive, many of them are under ownership of the corrupted profile and I cannot access them or assign new ownership in order to use them.  Attempting to "Make personal" in the context menu throws a "Error 0x80071771, The specified file could not be decrypted".

I followed some online help to access the hidden Admin profile and created a new profile to start rebuilding everything.  I AM able to log in to the corrupted profile (and have not deleted it), but am trying not to do so out of caution for screwing up more stuff.

Since the corrupt profile still exists, is there a way to locate and use the key so I can decrypt my files?

I tried running SFC Scannow and DISM's Restorehealth commands, both of which are saying everything looks fine.  SFC did initially say it found some corrupted files and then repaired them, but the old profile is still missing all of my desktop files, wallpaper- obvious clues that it's still royally messed up.

Does anyone have any ideas on how to decrypt files owned by a corrupted profile?

Thank you so much!!!

Best,

Chris

|
Hi Chris

My name is Andre Da Costa; an Independent Consultant, Windows Insider MVP and Windows & Devices for IT MVP. I'm here to help you with your problem.

If its the same computer the the files were encrypted on and you already have the EFS certificate file, then all you need is certificate file in order to decrypt on the same computer.

Sign into the new account.
Open File Explorer on the Taskbar > This PC
Open the drive where Windows is installed
Open Users
Look if your old account old is there with your files

If they are, you can copy them over to the new account.

Use these steps to then decrypt them:

https://www.tenforums.com/tutorials/77174-decry...

Information in the above link is sourced from a trusted Microsoft MVP blog.
Best regards,
Andre Da Costa
Independent Advisor for Directly

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hey there, Andre:

Thank you very much for your quick response.  I finally got a chance to try troubleshooting per your suggestions.  Here's what I came up with.

I apologize if I wasn't clearer in my issue originally. The files themselves were never actually ON the same drive as the OS.  THE OS was on drive C.  My files were on drive F.  However, I had somehow encrypted those files with my profile... and now that profile is corrupted. 

I tried the suggestions on   that you linked, and these are my results:

  • Option 1: Change File Ownership to "Personal" in the context menu results in following error:
    • An unexpected error is keeping you from applying properties to the file.  IF you continue to receive this error, you can use the error code to search for help with this problem.
    • Error 0x80071771: The specified file could not be decrypted.

  • Options 2 and 3: Decrypt Folder or File, (respectively), in Advanced Attributes:
    • Trying to remove encryption by deselecting the "Encrypt contents to secure data" checkbox in the Advanced Attributes window yields the following error:
      • An error occurred applying attributes to the file: F:\EXAMPLEFOLDER\EXAMPLEFILENAME: The specified file could not be decrypted.
  • Options 4 and 5: Decrypting Folders and Files in Command Prompt, respectively:
    • When running cmd prompt in Admin mode, and executing the cipher /d and cipher /d/s: commands, the following error is thrown:
    • F:\EXAMPLEFOLDER\EXAMPLEFILENAME\:  the system cannot find the path specified.0 file(s) [or directorie(s) were decrypted.
    • This is problematic, because I can click on the folders and files themselves from the windows GUI. 

I still have the corrupted profile on my computer... is there a way to reach into it to extract the cipher?

Thank you so much for your help!  (Didn't expect to take a crash-course in Windows security, but there we are, LOL).

Best,

Chris

 

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Was a EFS file created in the now corrupt user profile before the corruption took place?

If it wasn't, then I'm afraid there really isn't much that can be done.
Best regards,
Andre Da Costa
Independent Advisor for Directly

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Honestly- I'm not really sure.  I'd imagine creating an EFS file is a deliberate process, whereas I'm pretty sure the reason I got into this mess was  by randomly clicking "Enable Bitlocker" on the drive.


Is there a way to search for or locate the file itself?  What's the file suffix?

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

As you concluded, it would require that you created and saved it. If you don't remember doing this, then its likely you never did create.

It might be stored in your Microsoft Account.

Sign in https://account.microsoft.com/devices

Under your device, click 'Get Bitlocker Recovery Keys'
Best regards,
Andre Da Costa
Independent Advisor for Directly

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Thank you, Andre.

I appreciate your tenacity!

Best of luck (at least, better luck than me!! :-P)

Gratefully,

Chris

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Keeping my fingers crossed Chris.
Best regards,
Andre Da Costa
Independent Advisor for Directly

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

 
 

Question Info


Last updated July 6, 2021 Views 227 Applies to: