End Google Ads 201810 - BS.net 01 --> Hello All,

I have seen the NTFS undelete code on this site. I have also created a similar application to create a copy of file by reading its information from the metadata files on NTFS. The undelete code helped me a lot.

Now I want to create a copy of encrypted file. I have retrieved the EFS attribute from the MFT record and copied encrypted source file's data to destination file. But I could not find structure for EFS and do not know how to decrypt the file's data.

Can anyone give me a idea of how can I decrypt file's data using the information from the EFS(Encrypting File System) attribute ?

Thanks.