Posts by grehe

I know this is an old thread, but for the record, EFS headers are kept on a separate hidden file. Specifically, it's kept on the MFT. Filename should be "mySecret.txt:$EFS" . There is no way to read the header unless you use a hex editor.