Re: Recovering encrypted files and folders

From: Steven L Umbach (n9rou@attbi.com)
Date: 03/31/03 

From: "Steven L Umbach" <n9rou@attbi.com>
Date: Mon, 31 Mar 2003 02:34:43 GMT

       If you formatted your hard drive before you reinstalled W2K, those
encrypted files are almost certainly never to be available again. Another
recovery agent will do you no good. The only two keys that can possibly
decrypt those files are YOUR user key and the recovery key for YOUR computer
which were used at the time the files were encrypted. The recovery key would
have been by default the local administrator, since apparently your
computer is not a member of a domain. If you backed up/exported either of
those certificate/keys you should still be able to decrypt those files
assuming they are available. Now if you did a reinstall and did not format
your drive and your old user profiles are still available you might be able
to extract the keys to decrypt your files. The profiles are under the
documents and settings folder and listed by user name. If you see two
administrator profiles, with one having a numerical increment extension or
other extension, then you may just be in luck. If you think the old profiles
are there and you can remember the passwords for those accounts, then you
could try a program that will try to decrypt the files or call Microsoft
support for instructions. Good luck and rember to always back up your
private keys to external media. --- Steve

http://www.crackpassword.com/advanced_efs_data_recovery.html
http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B243026
http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B255742
http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B242296

"Michael Neuhaus" <mikeneuhaus@comcast.net> wrote in message
news:035c01c2f728$264b3250$a001280a@phx.gbl...
> I had 3 hard drives on my PC. The first was W2K and
> Office. The second disk was copies of My Documents. The
> third disk had My Documents also. I know this sounds like
> overkill, but I have been hacked before. I encrypted the
> My Documents folder and all subfolders and files in it on
> the C: drive. I also did the same on the other 2 disks. A
> few days ago, the OS crashed. I reinstalled W2K before I
> remembered to decrypt the My Document folders and files on
> the other 2 disks. Now I can't access them. I tried the
> recovery agent, but it didn't work. I think I deleted a
> key, I don't know. I tried Cipher and it said it worked in
> the command line, but it didn't. I am running Pro, not
> Server. Is server required to use Cipher? I didn't install
> Cipher like I later learned you have to do. I just went to
> a DOS prompt and tried it. A friend said that I could
> either connect to a domain somewhere and use Certificates
> and keys that the domain controller would issue to me or
> the other choice, according to the MOC book is to send the
> files and folders to someone who is a recovery agent on
> HIS machine and he could decrypt them and send them back
> to me. My first disk is in a pull tray. Another suggestion
> was to buy a second pull tray and hard disk, install
> Server or Advanced Server (I have both) and then I could
> issue myself a certificate and keys and then go to the
> other 2 disks and decrypt the files. Can anyone please
> help me? I need these files ASAP, it's very important to
> me. Many thanks in advance. If anyone reads this, I don't
> know if I will find your post. PLEASE email me the answer
> if you can. I would be very grateful. Thank you.
> mikeneuhaus@comcast.net Have a nice day.