Hi,
I recently lost some data after a reinstall of Windows.

The lost files are Google chrome session files. In chrome the session files have no signature, as far as I know, so I'm thinking to scan the raw data of the drive for a hex string which I know will be in the files I'm looking for. The old files contained the ANSI "perplexity". I know this ANSI string hex will be in there because I created a new session using tabs I know were open in the old session files I'm looking for, then inspecting the hex of those files.

The problem is the files would have been encrypted. I've got the old Windows EFS encryption key installed on my new system but as I understand it, the string I'm looking for will be encrypted as it's not part of a file as far as the current OS sees it, it's just binary data on the drive not part of a file any more.

How can I find out the encrypted hex string I need to search for?