Re: Recovering encrypted files and folders

From: Peter Clark (clark@hushmail.com)
Date: 03/31/03


From: "Peter Clark" <clark@hushmail.com>
Date: Mon, 31 Mar 2003 06:07:47 -0800


http://www.beginningtoseethelight.org/efsrecovery/

>-----Original Message-----
> If you formatted your hard drive before you
reinstalled W2K, those
>encrypted files are almost certainly never to be available
again. Another
>recovery agent will do you no good. The only two keys that
can possibly
>decrypt those files are YOUR user key and the recovery key
for YOUR computer
>which were used at the time the files were encrypted. The
recovery key would
>have been by default the local administrator, since
apparently your
>computer is not a member of a domain. If you backed
up/exported either of
>those certificate/keys you should still be able to decrypt
those files
>assuming they are available. Now if you did a reinstall
and did not format
>your drive and your old user profiles are still available
you might be able
>to extract the keys to decrypt your files. The profiles
are under the
>documents and settings folder and listed by user name. If
you see two
>administrator profiles, with one having a numerical
increment extension or
>other extension, then you may just be in luck. If you
think the old profiles
>are there and you can remember the passwords for those
accounts, then you
>could try a program that will try to decrypt the files or
call Microsoft
>support for instructions. Good luck and rember to always
back up your
>private keys to external media. --- Steve
>
>http://www.crackpassword.com/advanced_efs_data_recovery.html
>http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B243026
>http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B255742
>http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B242296
>
>"Michael Neuhaus" <mikeneuhaus@comcast.net> wrote in message
>news:035c01c2f728$264b3250$a001280a@phx.gbl...
>> I had 3 hard drives on my PC. The first was W2K and
>> Office. The second disk was copies of My Documents. The
>> third disk had My Documents also. I know this sounds like
>> overkill, but I have been hacked before. I encrypted the
>> My Documents folder and all subfolders and files in it on
>> the C: drive. I also did the same on the other 2 disks. A
>> few days ago, the OS crashed. I reinstalled W2K before I
>> remembered to decrypt the My Document folders and files on
>> the other 2 disks. Now I can't access them. I tried the
>> recovery agent, but it didn't work. I think I deleted a
>> key, I don't know. I tried Cipher and it said it worked in
>> the command line, but it didn't. I am running Pro, not
>> Server. Is server required to use Cipher? I didn't install
>> Cipher like I later learned you have to do. I just went to
>> a DOS prompt and tried it. A friend said that I could
>> either connect to a domain somewhere and use Certificates
>> and keys that the domain controller would issue to me or
>> the other choice, according to the MOC book is to send the
>> files and folders to someone who is a recovery agent on
>> HIS machine and he could decrypt them and send them back
>> to me. My first disk is in a pull tray. Another suggestion
>> was to buy a second pull tray and hard disk, install
>> Server or Advanced Server (I have both) and then I could
>> issue myself a certificate and keys and then go to the
>> other 2 disks and decrypt the files. Can anyone please
>> help me? I need these files ASAP, it's very important to
>> me. Many thanks in advance. If anyone reads this, I don't
>> know if I will find your post. PLEASE email me the answer
>> if you can. I would be very grateful. Thank you.
>> mikeneuhaus@comcast.net Have a nice day.
>
>
>.
>



Relevant Pages

  • Re: Encrypting File System
    ... If you do not have back-ups of the original keys, ... Creating a recovery Agent after the fact will not work. ... There is not and there should not be a way to decrypt the data without ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Recovering encrypted files and folders
    ... decrypt those files are YOUR user key and the recovery key for YOUR computer ... to extract the keys to decrypt your files. ... The second disk was copies of My Documents. ... > recovery agent, but it didn't work. ...
    (microsoft.public.win2000.security)
  • Please help - a question on Ciphering...
    ... write a recursive function that iterates ... number of possibilities / number of keys tried per second ... The more words to decrypt, ... >Cipher. ...
    (microsoft.public.cert.exam.mcsd)
  • Please help - a question on Ciphering...
    ... write a recursive function that iterates ... >number of possibilities / number of keys tried per ... So yes, you could decrypt it, you just ... >>Cipher. ...
    (microsoft.public.cert.exam.mcsd)
  • Re: Encrypting File System Recovery
    ... created a new recovery agent for the administrator account ... which doesn't have the ability to decrypt my files for the ... >> Admin but since I haven't logged on as an Admin due to ...
    (microsoft.public.win2000.security)