I have some old backups that are encrypted using windows EFS and I no longer have access to the certificate used to encrypt the FEK symmetric key included in the files but I do have the password, user name and as well large portion of the actual binaries before encryption. I do know that AES used by EFS is not vulnerable to known plain text attack but I was hoping that with the above information I can figure out how windows generated the FEK symmetric key that are used to encrypt the file. Any help would be appreciated. Thanks.
FEK is random
Sorry. (But if it were any different, this would be terrible for EFS.)
Microsoft Corporation, TechNet, How EFS Works:
When you save a file to be encrypted, a random cryptographic generator supplies a unique file encryption key (FEK), which is a fast symmetric key designed for bulk encryption. The FEK encrypts the data in blocks.