Windows File Encryption recovery?

[MrScott81]

So I just reformatted my C:\ drive the other day and forgot that some of the folders on my D:\ drive were encrypted using EFS under Windows XP. Now I can't read, move or do anything with the files. Is there any way to get access to the files now?

 

[eigen]

Big fat no. (as far as a I know). Your certificate is gone so you cannot access your files. Having said that I is technically possible to recover both the certificate and the files but that is prolly outside both your/mine technically ability.

 

[Psych]

Are your files still "there" in the explorer? You could at least try to take back ownership if XP still recognizes them. There is slight possibility that the certificate could've survived the reformat, but you'd have to pay a lot of money to get the hard drive scanned.

 

[MrScott81]

yeah the files are all still there. the file names are all in green. when i try to copy or open the file, windows throws an error saying i don't have access to do so.

 

[n0cmonkey]

Restore the encryption key you backed up.

 

[JOHNGALT99]

go buy r-studio http://www.r-studio.com/ , and recover the certificate file from your hard drive.

I have used this to rover files from a drive i am deleted the partition on and formated

It even found files from 2 or 4 reformats ago , some of which i had overwriten with 1's and 0's by dod standards

 

[MrScott81]

where is the file certificate stored?

 

[hoppa]

if you safemode boot, you can access the files, and furthermore, under one of the properties thing you can set "ownership" to all, and access them again under a normal boot. i just dealt with that problem myself a few days ago. that doesn't mean you'll be able to unencypt them though

 

[Mrburns2007]

I really hate EFS, prefer PGP disk or safeboot vdisk. Make a backup of your virtual disk and your alot safer.

 

[n0cmonkey]

Originally posted by: Mrburns2007
I really hate EFS, prefer PGP disk or safeboot vdisk. Make a backup of your virtual disk and your alot safer.

If you properly back up your keys, EFS should work just fine.

Not that PGP isn't a great product.

 

[MrScott81]

so do you know where the file certificate is stored by default?

 

[n0cmonkey]

No, but I'd start looking here.

 

[NogginBoink]

Originally posted by: hoppa
if you safemode boot, you can access the files, and furthermore, under one of the properties thing you can set "ownership" to all, and access them again under a normal boot. i just dealt with that problem myself a few days ago. that doesn't mean you'll be able to unencypt them though

You really have no clue what you're talking about, do you?

Scott, the certificate store in usually in c:\documents and settings\username\application data\microsoft\crypto\rsa.

But you probably can't just copy that file to the new install. (Then again, maybe you can. It's worth a shot. But DO make SURE your password on the new system is the same as the old system so that you can get access to the master key history.)

 

[n0cmonkey]

Originally posted by: NogginBoink

Originally posted by: hoppa
if you safemode boot, you can access the files, and furthermore, under one of the properties thing you can set "ownership" to all, and access them again under a normal boot. i just dealt with that problem myself a few days ago. that doesn't mean you'll be able to unencypt them though

You really have no clue what you're talking about, do you?

Are you saying he is wrong? Do you have proof?

I was going to flame him, then I read the last sentence.