Re: Cannot Access EFS filesystem

On 8 Set, 12:51, "David H. Lipman" <DLipman~nosp...@xxxxxxxxxxx>
wrote:
From: "Marco Bellettini" <suddenlyfrustra...@xxxxxxxxx>

| Thanks for the reply: now, what would you suggest me to do if you are
| right? Is there any solution? Should I search on the filesystem
| for .pfx files (as an example) and import it somewhere (where, how?)?
| Can you suggest me a pointer I can look at?
| By the way, by using the trial version of "Advanced EFS Data
| Recovery", I could read the first 512 bytes of every encrypted file
| (expecially text files): this mean that the files and the certificates
| are ok. My feeling is that there is a sort of lock somewhere and the
| access to the encrypted file-system is locked until it is removed.

| Thanks again for you reply!

| Marco

If the original encrypting certificate was backed up into a .PFX you are in luck.  If it
wasn't, SOL...

--
Davehttp://www.claymania.com/removal-trojan-adware.html
Multi-AV -http://www.pctipp.ch/downloads/dl/35905.asp

Using EFS recovery I see that there are some key files in:
C:\Documents and Settings\%username\Application Data\Microsoft\Crypto
\RSA\S-1-5-21-1757981266-.......-1003\
Filenames are something like:
5bfa14d0bde9b240b9f9e954cfcb868a_f1225bce-..............
I've also had a look in this guide:
http://www.beginningtoseethelight.org/efsrecovery/
but it seems too dangerous to me..
Do you have any other suggestion on how to use the backup key files to
restore the encrypted file system in a "safe" and easy way?

Thank very much!
Marco
.