When copying EFS encrypted files from a mounted disk image you may see the following error:
When an EFS encrypted file is copied from a foreign file system using Windows Explorer the file is protected from regular copy and paste operations causing Explorer to fail the copy with the above error. Fortunately, Windows includes a file copy utility called RoboCopy (Robust File Copy) that includes parameters to copy encrypted files in RAW format that can be decrypted automatically on the original file system.
To copy EFS encrypted files back to your source file system
Start a command prompt with elevated privileges. See Running an elevated command prompt
To copy an entire folder (and sub-folders) containing one or more encrypted files, type the following command and press enter:
robocopy "I:\SOURCE" "C:\TARGET" /COPY:DATS /EFSRAW /R:2 /W:0 /E /ETA
Where "I:\SOURCE" is the source folder on the mounted image. Note: Do not include a back slash at the end of the pathFor reference the command line switches are detailed below:
Switch Description /COPY:DATS D Data, A Attributes, T Time stamps, S NTFS access control list (ACL) /EFSRAW Copies all encrypted files in EFS RAW mode. /R:2 Specifies the number of retries on failed copies. The default value of N is 1,000,000 (one million retries). /W:0 Specifies the wait time between retries, in seconds. /E Copies subdirectories. /ETA Shows the estimated time of arrival (ETA) of the copied files To copy a single file (or group of files using * wild cards) , type the following command and press enter:
robocopy "I:\SOURCE" "C:\TARGET" "FILENAME.TXT" /COPY:DATS /EFSRAW /R:2 /W:0 /ETA
Note: "FILENAME.TXT" can be the full file name or can contain wild cards using an asterisk. e.g, *.TXT will copy all files with a '.TXT' file extension.