#392·mimikatz

Decrypting the masterkey

Author: Taly01Created Apr 13, 2022Updated May 22, 2025

Hello I am trying to gain access to some encrypted files from before reinstalling windows. I am following this tutorial: https://github.com/gentilkiwi/mimikatz/wiki/howto-~-decrypt-EFS-files

I am stuck at Decrypting the masterkey

I know the password. It is the same user account and password I am using currently.

But yet with the command: dpapi::masterkey /in:"Protect\SID\guidMasterKey" /password:correctPassword

I get the error:

[masterkey] with password: correctPassword (normal user) ERROR kuhl_m_dpapi_masterkey ; kull_m_dpapi_unprotect_masterkey_with_password

Even with /protected and I get:

[masterkey] with password: correctPassword (protected user) ERROR kuhl_m_dpapi_masterkey ; kull_m_dpapi_unprotect_masterkey_with_password

I also tried the same command but with NTLM instead. dpapi::masterkey /in:"Protect\SID\guidMasterKey" /hash:correctPasswordInNTLM

I get this error instead:

[masterkey] with hash: correctPasswordInNTLM (ntlm type) ERROR kuhl_m_dpapi_masterkey ; kull_m_dpapi_unprotect_masterkey_with_userHash

As far as I know, I have the correct:

  • SID
  • guidMasterKey
  • Cleartext password / Password hashed in NTLM

The User Account that encrypted the data was a Microsoft Account and is the same one I am currently using.

The error seems to indicate that I am inputting the incorrect password, but I am sure I am using the correct password.

Is there anything I can do to recover my data? I have access to the old "ProgramData", and "Users" folders from before I reinstalled windows.

Any help would be very much appreciated Thank you