NTFS EFS - stuck after getting the FEK...

[plynch76]

Hi all,
I'm trying to decrypt some files that were encrypted using the EFS and
am stuck - I'm hoping that somebody has come across this same problem
(or knows how to get around it) :)

I'm parsing the MFT, gathering the attrs etc. When I get to an
encrypted file, I read in the thumbprint, then iterate the certs in
the cert store until I get the cert that matches (md5 in this case).

I then use that cert to decrypt the FEK. It is at this point, I'm
stuck...

I "think" I need to create a csp_blob (using the decrypted FEK as
args), set the PUBLICKEYSTRU args and then try to CryptImportKey based
on those. doesn't seem to work for me (no matter what combination of
args I use..)

Am I on the right track? or way off base?

any pointers would be greatly appreciate.

thanks in advance,
Pat.