Windows reinstalled system EFS decrypted data recovery successfully

Case:
One laptop computer of Windows operating system. During the use, for data security, the Windows encryption function was used. At one time, the system could not start. The customer reinstalled the system without backup the key. The original encrypted file could not be opened.

Solution:
The engineer first made a mirror of the hard disk to prevent the data from the secondary damage of the data, analyze the encrypted files, and find relevant information in the mirror.Extracted and generated the key from the mirror.Decrypt the encrypted files by self -developed software.Verification data can be opened normally.