Re: Recovering encrypted files and folders

From: x y, mvp (levinson_k@despammed.com)
Date: 03/31/03 

From: "x y, mvp" <levinson_k@despammed.com>
Date: Mon, 31 Mar 2003 09:03:16 -0500

I agree. You need to have a copy of at least part of the user profile e.g.
under the \documents and settings\ folder, or else the files are gone
[unless the computer was attached to a Windows 2000 domain].

If you did not format the partition containing the encrypted files, you
could try using undelete utilities from www.download.com, www.freeware.com,
etc. to try to find unencrypted deleted copies of the files in the unused
space on your hard drive. No one has yet come back here and said they had
success with this yet, so let us know if it works for you.

"Steven L Umbach" <n9rou@attbi.com> wrote in message
news:7PNha.267929$L1.76535@sccrnsc02...
> If you formatted your hard drive before you reinstalled W2K, those
> encrypted files are almost certainly never to be available again. Another
> recovery agent will do you no good. The only two keys that can possibly
> decrypt those files are YOUR user key and the recovery key for YOUR
computer
> which were used at the time the files were encrypted. The recovery key
would
> have been by default the local administrator, since apparently your
> computer is not a member of a domain. If you backed up/exported either of
> those certificate/keys you should still be able to decrypt those files
> assuming they are available. Now if you did a reinstall and did not format
> your drive and your old user profiles are still available you might be
able
> to extract the keys to decrypt your files. The profiles are under the
> documents and settings folder and listed by user name. If you see two
> administrator profiles, with one having a numerical increment extension or
> other extension, then you may just be in luck. If you think the old
profiles
> are there and you can remember the passwords for those accounts, then you
> could try a program that will try to decrypt the files or call Microsoft
> support for instructions. Good luck and rember to always back up your
> private keys to external media. --- Steve
>
> http://www.crackpassword.com/advanced_efs_data_recovery.html
> http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B243026
> http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B255742
> http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B242296
>
> "Michael Neuhaus" <mikeneuhaus@comcast.net> wrote in message
> news:035c01c2f728$264b3250$a001280a@phx.gbl...
> > I had 3 hard drives on my PC. The first was W2K and
> > Office. The second disk was copies of My Documents. The
> > third disk had My Documents also. I know this sounds like
> > overkill, but I have been hacked before. I encrypted the
> > My Documents folder and all subfolders and files in it on
> > the C: drive. I also did the same on the other 2 disks. A
> > few days ago, the OS crashed. I reinstalled W2K before I
> > remembered to decrypt the My Document folders and files on
> > the other 2 disks. Now I can't access them. I tried the
> > recovery agent, but it didn't work. I think I deleted a
> > key, I don't know. I tried Cipher and it said it worked in
> > the command line, but it didn't. I am running Pro, not
> > Server. Is server required to use Cipher? I didn't install
> > Cipher like I later learned you have to do. I just went to
> > a DOS prompt and tried it. A friend said that I could
> > either connect to a domain somewhere and use Certificates
> > and keys that the domain controller would issue to me or
> > the other choice, according to the MOC book is to send the
> > files and folders to someone who is a recovery agent on
> > HIS machine and he could decrypt them and send them back
> > to me. My first disk is in a pull tray. Another suggestion
> > was to buy a second pull tray and hard disk, install
> > Server or Advanced Server (I have both) and then I could
> > issue myself a certificate and keys and then go to the
> > other 2 disks and decrypt the files. Can anyone please
> > help me? I need these files ASAP, it's very important to
> > me. Many thanks in advance. If anyone reads this, I don't
> > know if I will find your post. PLEASE email me the answer
> > if you can. I would be very grateful. Thank you.
> > mikeneuhaus@comcast.net Have a nice day.
>
>

Relevant Pages

  • Re: EFS - Lost Certificate, Access is denied
    ... certificates\private keys with a file recovery program and try to recover them to the proper folder. ... If you have a backup of your user profile for that computer/specific operating system install from a time when those certificates/private keys existed you could also try recovering them from that backup and copy to your user profile. ...
    (microsoft.public.windowsxp.security_admin)
  • RE: TS User profiles location/moving
    ... In additon, when you set a Policy to delete local copies of cached roaming profiles, the user profile will get copied to the profiles folder, then deleted under "C:\Documents and Settings". ... If you are just interested in "My Documents", you can use Group Policy to implement "Folder Redirection" for this special folder. ...
    (microsoft.public.windows.terminal_services)
  • Re: Cached profiles not getting deleted
    ... user logs off a Terminal Services session to a Windows Server 2003- ... delete locally cached profiles. ... cookies folder and local settings folder ... a new user profile folder with their name appended with a new ...
    (microsoft.public.windows.terminal_services)
  • Re: homefolders, profiles and user rights
    ... "Additionally, since you're going to use roaming profiles, you really ought ... When using roaming profiles redirection of My Documents has just about ... Documents folder to the network you've essentially created a home directory ...
    (microsoft.public.windows.server.general)
  • Re: DNS configuration
    ... That's a good reason to use folder redirection. ... Application Data, and Desktop, in a custom GPO, linked at the MyBusiness ... Keep your profiles tinytinytiny! ... Profiles\single domain user folders: the same as yours: ...
    (microsoft.public.windows.server.sbs)