Decrypt EFS Protected Files by Recreating Missing User Certificates

If you have encrypted windows files from a previous user, these certificates needs to be recreated for your new user so you can unlock the files. For this method to work you need to have access to the /Users/ folder from your previous installation, along with the password or the NTLM hash.

Tools used: mimikatz and git bash (for openssl)

Steps:
00:00 Introduction and prerequisites
00:40 #1. Find out which certificate is needed for the encrypted file
02:30 #2. Download mimikatz
03:25 #3. Export the certificate to .DER
04:20 #4. Locate the private certificate
06:19 #5. Find and decrypt the masterkey for private certificate
09:17 #6. Decrypt the private certificate using masterkey hash
10:24 #7. Create the PFX certificate using openssl
13:40 #8. Install the new certificate


Tags:
#efs #bitlocker #certificate #pvk #der #pem #protected #decrypt #encrypt #files #windows #private #public #locked #access #mimikatz #cmd #rsa #crypto #microsoft #publickey #privatekey #masterkey #hash #ntlm #user #win10 #certutil #openssl #cipher