Re: recovering files encrypted using EFS

From: Seth (seth_at_equimax.com)
Date: 08/22/03


Date: Fri, 22 Aug 2003 16:41:50 -0500


How about creating a partition on a drive with enough space or using a spare
empty hard drive, then restore the image to that partition or drive, boot to
it, decrypt the files, copy them where you want them to end up and then
re-encrypt them.

Seth

"Montague Ring" <ringmbr@hotmail.com> wrote in message
news:063001c368f3$3140d560$a101280a@phx.gbl...
> Hello,
>
> I hope (deperately!) that someone can help me. Thank you
> in advance!
>
> I have two computers, call them COMP1 and COMP2. They
> both have WinXPpro installed. Using PowerQuest Drive
> Image, I made a backup of COMP1's harddisk on COMP2.
> There were some files (under Documents and Settings) on
> COMP1's harddisk which was encrypted using EFS. So those
> files on the backup on COMP2 are also encrypted.
>
> I then installed Windows Server 2003 on COMP1. Since
> Server2003 doesn't support upgrading from WindowsXP, all
> the program settings, users, etc were lost. I didn't,
> however, format the disk when I installed Server2003, so
> the Documents and Settings folder is intact.
>
> Although I have created a user in the Server2003 with the
> same name and password as the old WinXP installation, the
> new user obviously cannot access the files encrypted by
> the old user. Unfortunately, I forgot to export the old
> user's EFS Certificate before installing Server2003, so
> that's not an option.
>
> However, my thinking goes thus: I still have a fully
> intact backup of the old harddisk on COMP2, so although I
> didn't export the EFS certificate, it must exist in some
> form or other in the backup. I could of course restore
> the backup into COMP1, export the Certificate, then
> install Server2003 again, but I would like to avoid doing
> that if possible. Does anyone know of a method of
> salvaging the Certificate from the backup, or otherwise,
> could you tell me where the data of the certificates are
> stored under WindowsXP?
>
> I have tried to make this explanation as simple as
> possible, but the situation's a bit complicated, and
> sorry if it all sounds a muddle.
>
> Thank you for all your help.
>
> Monty