Re: RECOVERING MY ENCRYPTED HD FROM DEAD WINDOWS 2000

From: Peter Clark (clark@hushmail.com)
Date: 04/11/03 

From: "Peter Clark" <clark@hushmail.com>
Date: Thu, 10 Apr 2003 19:10:35 -0700

the failing in the last stages of setup sounds familar - i
think it has something to do with having a ntfs partition,
since this error does not occur on fat16/32

even though the other networked machine had access, the efs
certificates were probably only stored on the reinstalled
machine. certificates are generated "randomly" and are
critical to "quick" decryption. it is possible to match the
file encryption key (fek) - different for each file, due to
the 8byte encryption length and the fact that many popular
document formats have some standard bytes in - once matched
the fek can be applied to the remainder of the file. this
matching will take time, depending on the bit strength and
the host hardware used - though not impossible.

you main direction for decryption should be in restoring
the certificates. though you have updated and formatted it
is still *possible* that the certificates - very few bytes
in size are still on the disk - though not in the current
file system. is you are serious about trying this, power
down the machine now. on a different machine have a read of
this: http://www.beginningtoseethelight.org/efsrecovery/

>-----Original Message-----
>If you don't have the certificiates of the account which
encrypted the files
>or the certificates of the designated recovery agent of
the files (both must
>be done before wiping out aka formating the old
installation) then you are
>"out of luck" - there are no backdoors or hidden switches
to allow
>decryption.
>
>"some noob dude" <brown822@bellsouth.net> wrote in message
>news:2861ec1b.0304101440.4d24acbc@posting.google.com...
>> Here is the deal... I had Windows 2000 Professional on a
10 gig HD.
>> That drive had 2 parttions. C and D. Also installed was
a 120 gig HD
>> (E:) with all my "important stuff" like movies, mp3s my
web pages and
>> software backups.
>>
>> I encryted MOST of the stuff on that drive. Then the
other day I
>> installed WIndows XP Professional. When I started the
install I chose
>> the RECOMENDED option to Upgrade. The install wouldn't
get past the
>> final part of "Intalling Devices" and it would reboot
and do the same
>> thing over and over. So I reformated the C: partition
and did a clean
>> install. Now I cant acces my encrypted files because I
am not as smart
>> as I thought I was. I didnt know squat about encryption
and it seemed
>> like a good idea to have the data "secure". The question
is how do I
>> recover this data? I know it is possible, I also know it
wont be easy.
>> This computer was also networked with another WIndows 2000
>> Professional computer in the house, this computer had
full access.
>> Would I be able to access or decrypt the encrypted files
from that
>> computer once I get the network back up?
>
>
>.
>

Relevant Pages

  • Re: ENCRYPTED DATA RECOVERY
    ... The certificates can not be recreated. ... The Recovery Agent needs to be designated beforehand. ... If it is an Ownership issue and not an encryption issue, ... I had made the decision to do a clean install of XP on ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Certificate attributes for Smart Card Logon
    ... unfortunately, as far as I know if you have the "Secure Email" application Policy set, a certificate by default may not just be used for email signature but also email encryption! ... If you enable the Smart Card Logon, Client Authentication, and Secure Email application Policies, this ensure that the smart card cannot be used for actual encryption. ... My domain controllers each already have their own certificates. ...
    (microsoft.public.windows.server.security)
  • Re: Certificate attributes for Smart Card Logon
    ... signature but also email encryption! ... If you enable the Smart Card Logon, Client Authentication, and Secure ... controllers each already have their own certificates. ...
    (microsoft.public.windows.server.security)
  • Re: Sending signed and encrypted email.
    ... The user may have 1 or more certificates, ... via an AD lookup, you would want their encryption certificate, not their ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... I am new to framework 2.0 so unsure about the capabilities of the ...
    (microsoft.public.dotnet.security)
  • Re: Suse Linux 9.1 Personal Problem. Please Help
    ... Windows XP for example cannot play encrypted CD's "out of the box". ... A few years back people were able to crack the encryption meaning that ... The first thing to install are the Windows codecs. ... The package for SSUE ...
    (alt.os.linux.suse)