The present invention provides a method and system of reading at least one locked, encrypted computer file encrypted by an encryption filter driver running on an operating system of a computer system, with an added kernel driver, while the operating system is running and reading at least one locked, unencrypted computer file in a computer system with an operating system with an added kernel driver while the operating system is running. In an exemplary embodiment, the method and system include (1) getting the handle of the locked, encrypted computer file, (2) causing encryption key information associated with the locked, encrypted computer file to be processed, and (3) reading data from the locked, encrypted computer file by using the added kernel driver.