Hardware

Ask something
Question Locked

Decrypting files

0 helpful
13 replies

by geniusmind4

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hey guys, i m having a huge problem

one of my client encrypted files using EFS in win2000 pro, now some problem happened and no user is able to login except guest..i tried using that hard drive on another computer to decrypt files but files are not gtng decrypted, though folders were decrypted..
is there any solution ? i need that data , help me
Desperate

13 replies

by cmiller5400

Can you login as the administrator on the machine? If so, it should be a recovery agent, thus able to decrypt the files. On WinXP there is no recovery agent by default, one must be specified.

If that does not work, you may need the services of a data recovery firm. It probably is going to be very expensive if they can even get the data.

Best of luck!!

by nepenthe0

Without the [i]private key[/i], you cannot decrypt an encrypted file.

If your client refuses to disclose the [i]private key[/i], and you are extremely curious about what's in the encrypted files, there is a chance that your client used a relatively insecure password.

If the password is a simple 8-character alphanumeric combination, inexpensive commercial software exists that can [i]guess[/i] such passwords, allowing you access to the encrypted files. That's why security experts always emphasize [i]strong[/i] passwords.

Without the password, your chances of decrypting these files are negligible.

Rick/Portland, OR

by nepenthe0

The Microsoft TechNet link states:

"If another user tries to open the file, access is denied. No one else can decrypt the file without the encryptor's private key or a private key for recovery. This is true even if administrators change permissions or file attributes, or file ownership is shared."

Split key encryption (also known as [i]public key[/i] encryption) was introduced by Diffie and Hellman in their landmark 1976 paper. Within a year, Rivest Shamir & Adelman (RSA) crafted a viable protocol for actually implementing split key electronic encryption.

After a [i]near death[/i] experience, RSA took off under the direction of a bold and capable executive, and the company raked in money by the truckloads. RSA held a patent on their split key algorithm, conferring a legal monopoly.

Microsoft had only 1 place to go for a license: RSA. That is the algorithm underpinning EFS. There is no [i]back door[/i] so far as we know, although Microsoft refuses to publish the source code.

Most reputable 3rd party vendors of encryption software publish their source codes, so that experienced programmers and cryptographers can verify there is no [i]back door[/i]. See:

http://www.pgp.com/downloads/index.html

Notice that the [i]source code[/i] is published on the web site. Whether a secret [i]back door[/i] exists within EFS remains undetermined, and a matter of ongoing controversy.

Assuming no [i]back door[/i] exists within EFS, without the [i]private key[/i] (password), the files are just unintelligible gibberish, unreadable by anyone.

Rick/Portland, OR

by oh smeg

Restore the Backup. That way you get your Data Back reasonably quickly. IF you don't have a Backup of the Data and the Encryption Key you can take the drive to a Data Recovery House and pay a fortune and promise them your first born as well as anything else that they ask for or follow M$ advice which is [b]Find a Good Cracker.[/b]

The whole idea of using EFS to encrypt files is to prevent others looking at them and render them useless if they get stolen.

This may be of some assistance but I personally wouldn't be holding my breath waiting for a good outcome.

http://tinyurl.com/orpmf

This is also linked to from the above site but I don't know how much use it will be to you now. It should have been read before implementing EFS.

http://tinyurl.com/8gyuc

Col

by geniusmind4

Well, the thing is .. that OS is not working anymore....n somehow i managed to get a backup copy of that data on another computer. now the windows must be reinstalled..... :(

The problem is that .. the person himself doesnt know ....how and who encrypted those files , that person doesnt even know there is something like EFS in windows ,
so does that mean
THE DATA I HAVE IS USELESS NOW ?

by oh smeg

Will still be intact. You can then try to use the Emergence Boot Disc to repair Windows and then Backup the Files without the encryption.

http://www.ebcd.pcministry.com/

However if a In Place install has been performed or any thing else that writes the bulk of the Windows Files back the likely hood is that the Encryption Key has been destroyed. If that is the case you need to contact a Company who recovers Data from this situation as all you will get off the drive is Garbage that will remain unreadable.

So the correct answer here is that if nothing yet has been done to the drive it's possible to recover the Data & Encryption Key but if the drive has been attempted to do a Repair Install of Windows the Encryption Key has been destroyed.

Basically is it worth the expense of recovering the Data? If it is then send the drive off to a Data Recovery House and let them loose with it but you'll need Deep Pockets to pay for this. I'm not sure how much as even a guideline as I've never needed to do this previously. But here I believe that On Track charges $900.00 for a quote to recover data and if the job is approved that comes off the finial price. If they need to recover data off a dead drive the last one which was a 80 GIG 2.5 Inch IDE Drive cost $46,000.00 but I'm not sure what the charges are for Recovering Encrypted Data.

Col

by geniusmind4

Well.... now the situation is.... i can reach to windows logon screen..........but when i try to login it says........ "The local policy of the system doesnt allow you to logon interactively" ... whts up with that ? i cannot login with the administrator :/
and please tell me how to crack the windows password.. i have heard that if i delete the SAM .... all account passwords are set to be blank ... is it correct .... which SAM file and if not then how ... thats the last hope if i can login to that pc with administrator ... :(

by cmiller5400

Do not delete any files. If you smoke the SAM, your private key goes with it.

Listen to Col's advice. He knows what he is talking about.

Have you tried booting to safe mode and using the administrator account there?

by oh smeg

If you can not log in to either the users account or Admin Account which generally are one & the same I wouldn't hold out much hope that the Encryption Key is still intact.

As CM has already said the Encryption Key is tied to the Password of the account so if the Password is hosed I'm betting the Encryption Key will be as well. But try first to log into every possible User Account to see if you can get in at all or if you have a General Windows Failure.

If you can get in using another account try taking ownership of the Files on the corrupted account. Everything here depends on what's happened and how badly Windows has been damaged.

Col

This discussion is closed to new replies.