After Recovery no access to encryptedfol

Windows 2000 SR2
single computer (no domain)

Have the Administrator take ownership of the folder and files. Then you can do with it whatever you need to.

After you have taken ownership of the files, you are going to need to restore the EFS Keys... (Encrypted file system).

If you do not have those, you're going to be into a little bit of trouble.

You are then going to have to try to get back into the other system...

If worse comes to worse, and this doens't work for you, send me a note and I can help you with one last thing...

If that doesn't work, you're going to have to delete them...;(

mrafrohead
@yahoo.com

Hi,

Take a look at the following Microsoft tech note on importing keys...

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q242296

(remove spaces from above URL)

They say you need to have exported it first. Hope that doesn't get in your way...

Cheers,
Tim.

Answer 1: Not possible with encyption

Answer 2: Worse comes to worse, still no access

Answer 3: My original profil is unavailable, so I
cannot export the key

Is there a way to export the key without logging into the original profile? That would be the solution.

thanks for your help

Stephan

Hi,

Did you try simply copying in the cryto folder to your new profile? I presume you have...

If it doesn't work, then try encrypting another small part of your system (nothing important), export that key for later importing.

Then edit the files that were created and insert the key from the old profile. You may need to use a hex editor to do this.

Cheers,
Tim.

Hi,

When you say you tried it and it didn't work... which suggestion did you try?

I've done some further reading on this and the EFS subsystem also uses your SID in its calculations of a valid key. Your SID has changed with the re-install so any key you try to sneak in by inserting it into the files directly wont match.

"The HKEY_CURRENT_USER\Software\ Microsoft\WindowsNT\CurrentVersion\EFS\CurrentKeys\ CertificateHash Registry key stores the user's active EFS key pair certificate hash. If any of the components in the key field don't match the current key pair's properties, including the user's SID, EFS must update the key field."

Read the following article from which the above was taken. It describes EFS in GREAT detail.

http://www.win2000mag.com/Articles/Index.cfm?ArticleID=5592&pg=1

(remove spaces from above URL)

Try creating an encrypted area (as per my previous instructions), export the keys and use the hex editor on the export.

You'll need to find and replace the key pair from you old profile and also your old SID with the new one.

Then import the hacked files and hope that they work.... you can have more than one key pair on your system - it searches through them until it finds the right one.

Hope this helps. If you cant make it work, then you're getting to the point where you'll either have to send the files away to expensive specialists or kiss the data goodbye.

Cheers,
Tim.

Hi,

Offhand I dont know whether an installation over the top changes the SID or not. I suspect it might given the problems you're having.

But... either way it wont matter. When you're editing the export files, hopefully you'll be able to find the SID and compare it to what you had in your old profile. If they're different, then replace the SID in the export with the old one.

Good Luck,
Cheers,
Tim.

This question was closed by the author