Anton Altaparmakov wrote:
Re: [Linux-NTFS-User] $EFS Attribute Recovery

...Why don't you just run ntfsdecrypt on the ddrescue obtained image?!?  Or is the MFT damaged/missing so you cannot do that?

Unfortunately, yes, big-time $MFT damage.  ntfsls and Windows AUTOCHK.EXE (check-disk) both complain. :(

I've gotten some tips from Yuval F. to try out.  Perhaps I'll report back after trying them out.

Thanks for your response, Anton!

- Shao Miller