Discussion Locked

Need help with EFS encrypted files!

0 helpful
56 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
So I have efs encyption on for my hard drive, then i reformatted. So ibacked up all my videos, music, and 10 years worth of family photos on my external hard drive. I reformat, get all my programs and everything together and then go to my external hard drive to get the files, AND THEY ARE STILL ENCRYPTED!!!!!! windows forgot to take the flippin' encryption off the files. I talk to microsoft and the guy on the phone freakin' tells me to find a good hacker.......wtf?! I have searched ALL of the internet and have found that if i move the files to a hard drive that is formatted to FAT the files lose all encryption. But i can't move the dam files!!!! I have tried all the EFS recovery programs but they only get the original key and that drive has already been formatted. SOMEONE, FOR GOD SAKES PLEASE PLEASE PLEASE HELP ME!!!!! I have years and years of family photos and hundreds of dollars worth of music that i can't access. I can even see all the thumbnails to the pictures, MICROSOFT IS TAUNTING ME!!!!!!!

56 replies

by Member 25348569

Are you able to log on as Administrator and take ownership of the files? You should be able to do that and then move the files.

by zlitocook

Can not get passed the encryption after a few weeks let me know. If you don?t mind letting some one else seeing your files, I may be able to decrypt them for you.
But first you should have decrypted the files before formatting because the key was on the drive and under your profile. There are programs out there that will do this but most that you D/L will also have Trojans or virus attached to them. You could also send it to a data recovery company. But it will cost and they may ether not be able to help or destroy the data.
Try the UDCD and see if you can move the files to a second drive with fat32 or load Kloppix or another Linux distro on a second drive and move them from there.
I don?t like doing this and have to stay away from it, but if you don?t get any where let me know.
But there are alot of great people here and they might have a better thought about it.

by jdclyde

boot to a live distro of linux. It will completely ignore the windows security.

COPY your data to another drive. This gives you multiple attempts to screw it up.... I mean to unencrypt it. :D

by techexec2

YOU NEED TO UNDERSTAND YOUR SITUATION

You need to understand your situation.

[i]"I have searched ALL of the internet and have found that if i move the files to a hard drive that is formatted to FAT the files lose all encryption."[/i]

This is true, but only if you did that BEFORE you reformatted the original hard drive. The encryption key was stored on your original hard drive. All you can do now is copy the encrypted version around.

Your situation now: To decrypt the files now, you must BREAK the encryption. And, the encryption is designed to be difficult to break. In effect, when you chose to use encryption, you chose to put a powerful lock on your files. Now, you must break your own powerful lock.

ANOTHER IDEA

Another idea: If you just freshly reformatted the original hard drive and have not done anything else to it, you might (desperately) try to use a utility to recover that drive. If this were successful, you could decrypt your files.

LESSONS FROM THIS

This may be a hard lesson for you. Having just ONE copy of your system and files is dangerous. If the hardware fails, the software fails, or the user fails (i.e. makes an error as in this case), that one copy is lost. So, the thing to learn from this is that you must have multiple backups to protect yourself.

Good luck to you.

edit: spelling

by thehebrew

Thank you guys so much, this has been the most helpful site; everyone else just says I'm stupid. I did turn encryption on a while ago but when ever I moved file/folders onto my external drive it always used to take the encryption off, so I assumed (<-- stupid) that it did it like usual. I really didn't know anything about the certificates or about the encryption when I was using it or I would have definitely backed up the certificates. Anyway, I can change the ownership like suggested but there are only 2 options and I don't know which one is right. I tried both and then tried to copy and move the file after I did it but it didn't work. Do i have to restart after changing ownership? It just gives me an access denied error message. I think I'll try running a Linux distro off a thumb drive and then copy the files to the thumb drive. Anyone have any suggestion of a really small Linux distro that would run off a thumb-drive? Also, I heard that if copied to a FAT32 drive the encryption is completely useless, but I was thinking; once I have them on the FAT32 drive how do I get the encryption off so I can transfer them back onto a NTFS drive? Should copying just do the trick? And if someone wants to try and unencrypted some files i have a folder of Java programs ,b/c I'm a college student, that you could take a crack at; but that is assuming that I'm able to move or copy the folder. Thank you guys soooooo much, you're all life savers!!!!!!!!

by techexec2

You're still a little off-target:

-----

[i]"I can change the ownership like suggested"[/i]

Changing ownership is not going to help you. The problem is that your data is scrambled by the encryption and you no longer have the key.

-----

[i]"Do i have to restart after changing ownership?"[/i]

No. But as above, changing ownership is not the problem.

-----

[i]"I think I'll try running a Linux distro off a thumb drive and then copy the files to the thumb drive."[/i]

Running Linux is not going to help either. You need to decrypt the data inside the files.

-----

[i]"once I have them on the FAT32 drive how do I get the encryption off"[/i]

You must BREAK the encryption. You must CRACK your own encryption.

-----

[i]"everyone else just says I'm stupid"[/i]

Did I forget to say you were stoopid? :-). Sorry about that :^0.

Everyone has done something stoopid before. Even me. Even JD. JD will deny this. You watch. :^0

-----

Good luck to you.

by jdclyde

The first thing he should try is to reclaim the permissions. That is why I suggested the "COPY" option.

As he doesn't have permissions, how does he know if it is still encrypted?

He should try to reclaim them first (which he would have to do anyways before he could decrypt) and then get back to us. :D

by douahe

I was reading your post about cracking EFS encryption. Do you have some suggestions to how to go about cracking the encryption? My situation is a little different in a this post "Need help with EFS encrypted files!". I clone my hard drives so I have all the same information. When restoring my hd from the clone, I can access all my files that are on that hd. But, I also have a significant number of encrypted documents on an external hd. The files on the external hd I cannot access. The files were all encrypted at the same time as the ones on the hd. Do you have any suggestions on how to gain access to my files? Thank you for your help.

Helgi

by techexec2

JD's reply to me prompts some questions. In your posts you have said some things that appear to contradict each other. So, it's really not completely clear where things stand.

-----

Regarding:

[i]"when ever I moved file/folders onto my external drive it always used to take the encryption off"[/i]

Are you saying you are SURE that the files on the external hard drive were not encrypted before you reformatted the system HDD?

If the answer is "yes", then they are STILL not encrypted and security is locking you out, not encryption. In that case, all you need to do is reclaim ownership of the files on the new system you installed.

-----

Regarding:

[i]"I can change the ownership like suggested"[/i]

Have you already changed ownership successfully? Or, not? I thought this meant you had already reclaimed access but were still being denied access.

-----

Regarding:

[i]It just gives me an access denied error message.[/i]

Please provide the exact error message text. Recreate the problem if you didn't write it down the first time. We must know the exact error message in order to understand what is going on.

-----

I have more to say but I'll wait for your reply to this.

edit: clarity

by thehebrew

I meant that before I formatted, that when I moved files/folders to my external hard drive it usually automatically took the encryption off. But for some reason it did not do that for the files/folders; I know for sure that they are encrypted. Srry for the confusion and thanx for your help!

by thehebrew

Also, recovering the drive where windows was originally installed was the first thing I though of when I found out about the certificates but by them it had gone through a format and data was already moved onto it and the recover program couldn't turn up anything.

by hal 9000

Could recover or rebuild the last Bootable HDD but these are not cheap and it generally cheaper to just break the encryption.

Col

by techexec2

This is what you're up against.

From reference (1):

[i]"The process of enabling EFS is quick and simple, but the consequences of losing your private key can be catastrophic. If your user account is damaged or deleted then you will almost certainly lose the decryption key and your data will be effectively lost. To avoid this you should backup your personal encryption certificate immediately after the service has been enabled."[/i]

EFS RECOVERY TOOL

I have no experience with this tool, but it looks pretty good. It's called "Advanced EFS Data Recovery" (7). They say [i]"With Advanced AEFS Data Recovery, protected files can decrypted even in a case when the system is not bootable and so you cannot log on, and/or some encryption keys (private or master) have been tampered."[/i] and [i]"The latest addition to ElcomSoft's family of password recovery software allows business managers to deal with lost and destroyed encryption keys"[/i].

Caution: This company, Elcomsoft, is based in Moscow, Russia, and appears to be highly competent. I don't want to disparage our Russian friends. I like Russia! I cannot say there is any more lawlessness in Russia than in the USA. But, I can say that it will be more difficult for a USA person to get justice if the perpetrator is in Russia. Proceed as you deem appropriate.

IF YOU ARE SUCCESSFUL

I you successfully crack your EFS encryption and recover your data, please post back and let us know what you did and how well it worked. We may need to know one day. Thanks.

REFERENCES

(1) Windows XP Pro: Using File Encryption ? part 1
http://www.practicalpc.co.uk/computing/windows/xpencrypt1.htm

(2) Windows XP Pro: Using File Encryption ? part 2
http://www.practicalpc.co.uk/computing/windows/xpencrypt2.htm

(3) Windows XP Pro: Using File Encryption ? part 3
http://www.practicalpc.co.uk/computing/windows/xpencrypt3.htm

(4) Windows XP Pro: Using File Encryption ? part 4
http://www.practicalpc.co.uk/computing/windows/xpencrypt4.htm

(5) Windows XP Pro: Using File Encryption ? part 5
http://www.practicalpc.co.uk/computing/windows/xpencrypt5.htm

(6) Data Protection (EFS on Windows 2000)
http://www.microsoft.com/technet/security/prodtech/windows2000/w2kccadm/dataprot/w2kadm21.mspx

(7) Advanced EFS Data Recovery
http://www.crackpassword.com/products/prs/mswin/

edit: caution about Elcomsoft

by thehebrew

Thats the first tool I used, but what it does (i'm pretty sure) is that it scans the hard drive for any sign of a key. Well, I already formatted that hard drive and data has already been written to it. Do you think deleting that partition and then scanning may work? There prob. a good chance that it has already been written over but would that even work? Thanx for all the help!!!!

by tig2

HOW did you format? Quick format? Complete format?

In a complete format, you pretty much clobber everything. Can things be recovered? Yes but generally only fragments and then only with a pretty powerful tool. But it can happen- which is why when you dispose of HDDs, you have to run a kill disk cycle- completely overwrite all of the drive, generally with multipass ones and zeros.

All Quick Format does is wax the Boot Sector and the directory structure. It is entirely possible to use a recovery tool to get at data that may not have been overwritten by the OS footprint.

I hope you used Quick Format...

Edited because I must

by techexec2

I thought he already reclaimed access and was failing to get access due to the encryption. Perhaps not. His language is not entirely clear.

Sometimes it is a matter of "reading between the lines". And, you might have done a better job of it here :D. We'll see what he says.

by thehebrew

Yeah, I should read over what I type before I submit so srry if any of my posts are unclear. I selected all the files/folders that are encrypted, then go to properties, security tab, and then I click on the Advanced button. On the window that pops up, i click on Owner tab; now I'm looking at 2 accounts. I select one then click the "Replace owner on subcontainers and object" box and hit Apply. After that I try to move and copy the folders/files but an error message pops up and says : "Cannot copy (name of the file im trying to move): Access is denied. Make sure the disk is not full or write-protected and that the file is not currently in use."

by hal 9000

http://tinyurl.com/3aw7

And belatedly here is what you should have done to save your Encryption key it a good lesson none the less though a bit of a nasty one as well.

http://tinyurl.com/orpmf

Now what many people are unaware of is that before any Encryption System can be released the Government [b]Must Have[/b] the ability to break the encryption so they can recover the data possibly for evidence in Court Proceedings so while it's hard for the average Joe to do there is a [b]Back Door Available.[/b]

When you use Encryption the files stay encrypted whenever you move them about and even if you had of backed up all of your Data the Files would still be encrypted no matter the format of the drive that they where copied to even a Nix Drive would store them as Encrypted from the original Windows Source. The reason that you could read these files is that you where working off the original computer with the [b]Encryption Key[/b] so the encryption was effectively Transparent to you.

Now the easy answer to your current dilemma is to approach someone working for the [b]Federal Crime Authorities[/b] and they'll be able to break the encryption in a matter of seconds but for some strange reason they don't hand out this information as it's fairly useful to them again for fairly obvious reasons.

There is another possibility here [b]Get My Data Back[/b] is a company which was setup by several retired [b]Fed Data Recovery Specialists[/b] so they have the knowledge and ability to break the encryption though they may not have the motivation but are worth a try here

http://tinyurl.com/rmvrv

Actually the person from MS gave you some very good advice as any decent Hacker will know the Back Door into the Encryption bypassing method and will be able to recover your data and most likely do it for free into the bargain though as they break things for fun you never actually know if they'll keep a copy and do with it as they please. However you may find someone who wants the [b]Bragging Rights[/b] who is interested in performing the recovery.

Now I've never actually broken the encryption on any product to recover data but it is in Theory possible to perform I would recommend starting [b]Hacking for Dummies[/b] as a starting point and work forward from there.

As the data is already scrambled I don't think that using something like Knoppix will actually do anything but keep coping garbage admittedly a perfect copy of the garbage but garbage none the less.

Now if you had performed a Backup and at the same time backed up the Encryption Key which is a [b]Must Do[/b] item you wouldn't be in the predicament that you are in now as you could use the Encryption Key to recover your data and turn it from Garbage to readable Data once again. The fact that you have 10 years worth of Data Encrypted I think is marvellous and borders on the unbelievable as that's a long time for any computer program to be running and even longer for a computer as you must have changed it at least once if not more in the meantime. Do you still have the working old computer? If you do the [b]Encryption Key[/b] will be there and will have been transfered along with your data so you could recover it from there quite easily and have your data back to normal easily.

While it is a [b]Dumb Thing to do[/b] it is also a fairly common thing to do by many who don't know any better and think that they are making their system more secure. [b]The Really Dumb Thing[/b] that you have done here is not to research your procedures for a proper Backup and you haven't been keeping any proper Backup in place which is something that you should [b]Change Immediately![/b]

If you wish to use any form of [b]Encryption[/b] you should be at the very least using an [b]Image of the Boot Drive[/b] to restore from as that keeps everything that you need in place and gives you at only a small cost an easy and fast recovery method.

Whenever I run into domestic situations who have turned on the Encryption I immediately save their data and turn off the encryption and I also do this even in small business that I do work for as the costs involved in recovering the encryption key is just so expensive as not to be worth the cost in most cases.

This reminds me of a One Man Show who I built a computer for and told him to Save All His Data regularly. Well he insisted that he was backing up his data and when the HDD failed an old one from his previous computer as he was too cheap to spring for the $100.00 drive he lost all of his data but for the Company Financial Records which was what he was religiously backing up after every entry session. He didn't seem to grasp that he had other data on the drive that he wanted to keep. But on the other side of the coin he did save about $25.00 when I eventually had to fit a new HDD to the computer and he passed up the opportunity to get one of the data recovery houses to recover all his data as it was only going to cost at a minimum of 3K and possibly more to get all his photos and the like back.

So the easy answer is if you know someone who works for the Feds who has access to the [b]Computer Crimes Side of things[/b] you can ask them to make your Encrypted files usable, or you can start reading up on breaking Encryption Keys and find some of the tools that are used to hack these Keys. If you get lucky you may even find the back Door into the Files and recover them all. But I wouldn't be holding my breath waiting for a [b]Lucky Break.[/b]

By the way don't feel bad about doing a [b]Dumb Thing[/b] as we all manage to do [b]Dumb Things[/b] during our lives my worst mistake was to start working with computers and it's something that I've never recovered from though a close second would be using MS Software in the form of OS's. :)

Col

by tig2

http://tinyurl.com/fknb2

Google is your friend. Don't just try strings that you think will work, try a variety of strings.

Learn the following mantra, keep it wholly (intentional mis-spelling) "I will back up my keys, I will back up my keys, I will back up my keys". Learn it, Live it, Love it.

If you want to encrypt data and it does not contain credit data, personal data, banking data, ets, burn a copy (unencrypted) to disk and hide it where you can find it.

NEVER toast your box until you have first VERIFIED that your backup is good- preferably on another system.

I know that you know all this. I am just sad for you. Data loss is not good and it sounds like you have been trying hard to get this dealt with.

Good luck!

by danlm

What I do encrypt is my thumb drive. All of the things that I think I need at all costs are stored there. Including keys for ssh. This way, when I'm done with that stuff. I unplug it.
I only put on my main drive programs, the rest goes to partitions or the file server. And that is a UNIX box with UNIX file organization.
But, I know the feeling. I had that box hacked once and they deleted everything on me. Maybe that's why I'm so paranoid about ssh, keys, and stuff.
I hope you get your stuff back.

Dan

by hal 9000

Did you try reading this HDD on another computer to make sure that you could actually read your files?

I very much doubt that the Encryption was ever removed when you copied the files to an external storage device it's just that because you used the same computer to read them the Encryption became Transparent to your and you forgot about it.

Even MS accepts [b]Well Actually Warns you[/b] that when you copy [b]Encrypted Files[/b] they remain encrypted. So I can not see how the Encryption Would be removed just by a simple Data Copy.

Even on a Big Business/Government machines where Data Encryption is a [b]Must Use[/b] the files always remain encrypted no matter where they are copied to or how that they are copied unless it is in plain text format.

Once you Encrypt files they stay that way till you remove the encryption and there is no way around this.

[b]Just one thing here you'll at the very least need to make another copy of these files before attacking them with hacking tools, make sure that you always have an untouched copy available to refer back to should something go wrong and you loose the original data. As you already have the files on an External Storage Device copy them from there and then unplug that device and place it in a safe place where it can not be wiped as you may need the data on it at some stage in the future. [i]This is really Important![/i][/b] Once you have your data readable you can then proceed to wipe the Encrypted Files but don't consider doing this before you have usable data present. This may require another External Storage Device to be purchased but it's needed as you never attack the original data if you make a mistake you'll loose everything with [b]No Hope Of Recovery.[/b]

Col

by thehebrew

Well, for one thing; when I used to move files onto my external drive a window popped up and said that if I moved the files that they would have to lose their encryption and I clicked yes. I guess this time the window popped up, i dont remember. I was busy backing up and saving all my data and I assumed it either did it automatically or that I just clicked the box away like usual. And i know they were unencrypted b/c thats how I would transfer files to other computers. Also, thats one of the big problems im running into now; I CAN'T COPY THE DATA. I've been trying everything but it just throws me an error. If I was able to copy it I would have posted some files to see if anyone wanted to take a crack at it. Thanx

by hal 9000

http://tinyurl.com/gwe4m

Though from everything that I've read in the Public Domain you need at least the original OS to unlock the encrypted files which in your case no longer exists so I'm not sure if any of these will be of any use to you.

Knoppix STD is very good as a security tool on a non working Windows Install but it relies on the original keys being present so I would rule that one out straight away.

But there may be something else useful on that page or at the very least a possible link to somewhere else that may prove useful.

Col

by thehebrew

sounds like someone really knows what they're talking about. Yeah, the only reason the encryption was on was b/c I saw in one of my magazines about it and just randomly turned it on......not knowing what it was, or specifically what it did. When I turned it on I already had a couple years worth of data, so I haven't been using the encryption for 10 years. I've been searching everywhere on the web but this site has been the hands down BEST site. I guess i'll start reading up on hacking efs encryption but, like you said im pretty much waiting that one genious or erally nice hacker. And hey, if they want to keep copies of the files, i dont give a dam. What are they going to do with Java programs that sort things and family photos?........or what COULD they do with them? lol

by awrjunk47

Hi, I recently lost 10+ years of data and have been trying to discover a way to recover them. My files were backuped using Ntbackup to an external drive and then encrypted. Lost my original Win 2000 machine and had to reformat and load new OS but didn't realize I would not have access to my encrypted backup! Did you ever find a resolution to your problem because I also need help. Thank you for your quick reply @ awrjunk47@cox.net

by thehebrew

Nope, i still haven't found anything. I'm waiting for some genius to pop up on one of my posts on one of ten forums i have posted on. Or maybe a very nice hacker, which the guy at Microsoft suggested I find. Srry.

by adiabloa

well same problem happened to me
and the thing is i really need to get these files back, if you know any site that can do this but maybe for a cost or anything plz show me
or if you think you can do it and you do succes to do it i'll pay you 100$ i know its not alot but im a poor student and we students have a hardtime already as it is ... so be a doll and help me out ...

by pc21geek

Follow the instructions :
1. Login as Administrator

2. Go to Start/Run and type in cmd and click OK.

At the prompt type cipher /r:Eagent and press enter

This prompt will then display:

Please type in the password to protect your .PFX file:

Type in your Administrator password
Re-confirm your Administrator password

The prompt will then display

Your .CER file was created successfully.
Your .PFX file was created successfully.

The Eagent.cer and Eagent.pfx files will be saved in the current directory that is shown at the command prompt. Example: The command prompt displays C:\Documents and Settings\admin> the two files are saved in the admin folder. (For security concerns, you should house the two files in your Administrator folder or on a floppy disk).

3. Go to Start/Run and type in certmgr.msc and click OK. This will launch the Certificates Manager. Navigate to Personal and right click on the folder and select All Tasks/Import. The Certificate Import Wizard will appear. Click Next. Browse to the C:\Documents and Settings\admin folder. In the Open dialog box, change the Files of Type (at the bottom) to personal Information Exchange (*.pfx,*.P12). Select the file Eagent.pfx and click Open. Click Next. Type in your Administrator password (leave the two checkboxes blank) and click Next. Make sure the Radio button is active for the first option (Automatically select the certificate store based on the type of certifcate). Click Next. Click Finish. (You'll receive a message that the import was successful). To confirm the import, close Certificates Manager and re-open it. Expand the Personal folder and you will see a new subfolder labeled Certificates. Expand that folder and you will see the new entry in the right side column. Close Certificate Manager.

4. Go to Start/Run and type in secpol.msc and click OK. This will launch the Local Security Policy. Expand the Public Key Policies folder and then right click on the Encrypted File System subfolder and select Add Data Recovery Agent... The Wizard will then display. Click Next. Click the Browse Folders... button. Browse to the C:\Documents and Settings\admin folder. Select the Eagent.cer file and click Open. (The wizard will display the status User_Unknown. That's ok). Click Next. Click Finish. You will see a new entry in the right side column. Close the Local Security Policy.

You, the Administrator are now configured as the default Recovery Agent for All Encrypted files on the Local Machine.

To Recover Encrypted files:

Scenario #1

If you have completed the above steps BEFORE an existing user encrypted his/her files, you can log in to your Administrator account and navigate to the encrypted file(s). Double click on the file(s) to view the contents.

Scenario #2

If you have completed the above steps AFTER an existing user has already encrypted his/her files, you must login to the applicable User's User Account and then immediately logout. Next, login to your Administrator account and navigate to the encrypted file(s). Double click on the file(s) to view the contents.

*Warning

Do not Delete or Rename a User's account from which will want to Recover the Encrypted Files. You will not be able to de-crypt the files using the steps outlined above.

by thehebrew

You do realize that these files come encrypted from a hard drive and user account that was formatted over. thank you for trying to help but I tried it and it didn't work. I only have one account on my computer right now and uses the same name as the old account did. I did notice though when I was looking at the files that when I click the "details" button next to "encrypt" that it does have the thumb print of the old account that has access to it. But i can't remove it or add a new account. Thanx

by thehebrew

Yea, if no one was clear before, I am definitely willing to pay to get these files decrypted. So, any honest hackers out there?.....

by bhatnagar_nitin9

If you really formatted your hard drive with all your files encrypted in microsoft windows, then there is no way out to retrieve them from windows operating system. Infact, no programme out there in the market can retrieve them which are based on microsoft technology.
There is only one way which I can see is to recover your files using Recovery agent from EFS. But for that you need to have your private key which was created when you first encrypted your file. But since you have formatted your hard drive, your private key is also now lost and no way you can retrieve it. I had lots of, lots of problem with this EFS in Microsoft. Unless you are an expert on EFS, you should not use it.
Now, thinking of recovering your private key from your formatted hard drive, you should better look for such programmes who can retrieve data from formatted hard disk, which, unfortunately I don't think even exist. Your only bet is to catch Microsoft Corporation in order to get them back for you.

For your readings, you may want to look at the following articles:

http://www.atlguide2000.com/links/index.php?act=cat&cat=183

and

http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/cryptfs.mspx

by thehebrew

O dear is right, now you're on track to my situation. The hard drive I formatted has been long written over since, and in fact I completely sweep'd the drive before so there's no way in hell it was there afterwards. That why I am looking for a hacker, and its just some priceless things I need, if the hacker wants to keep copies of family photos and high school/ college papers, he can, i don't care. I tried Microsoft but they won't even take my situation seriously, all I get is crap tech support. Thanx for trying to help.

by now left tr

What was the reason exactly?

The whole mess you are in now is what EFS was designed to do.

Best bet would be to find a disk recovery shop / site and post the disk away. Hope you have nothing illegal on it.

by hal 9000

You would need a Forensic Data Recovery Service like that used by the Feds to recover every layer of data off the HDD. This results in the destruction of the HDD and the loss of lots of money.

Besides the Government Agencies there are only 2 places that I know of that are capable of doing this type of work and that is XWays in Germany and On Track as both can dismantle the HDD coat the platters and then read directly off the platters. Though this is really expensive a a bit extreme for something as silly as using a Free M$ provided so called Security Tool.

Maybe it's M$ way of keeping the Data Recovery Houses in Business.

Col

by thehebrew

If i thought that would work I would do it, but the fact is, is that an hour after I wiped the hard drive, I reinstalled Windows onto it and used it for a couple days before realizing that the data was encrypted (I don't look at photos and old documents all the time.) By then the hard drive had been written many times over, and I'm actually using the same drive right now. My bad, i know.

by thehebrew

I don't really know, I was reading Maximum Pc and it had an article on it, and b/c i'm paranoid I thought it was awesome and turned it on........bad idea. I moved all the encrypted stuff onto my backup hard drive, and I wiped anything that would be considered illegal. Like I said before: It's just photos, music, and documents. But the photos date back 10 yrs. where some family was still alive and needless to say, the pictures can't be retaken.

by why me worry?

Stop dwelling upon why he decided to use EFS and instead offer a solution to the problem. There is no sense in finger pointing after the fact that the problem already exists. You would make a fine IT manager in some lawfirm, where they waste more time looking for people to blame instead of working on a solution, regardless who was at fault.

by now left tr

you need to understand the past motive.

To answer your question - a recent TV advert informs me that the answer is to get 'Quick & Cheap Car Insurance'.

by hal 9000

But it involves destroying the HDD and then coating the platters with some green goop and allowing them to dry off then placing them into a special machine and read each layer of data. Because nothing every works perfectly you do not get a bunch of 0 & 1 but some minor differences with each layer.

The down side is that it's time consuming and [b]EXPENSIVE as Hell.[/b] Of course if you know someone within the Federal Computer Crimes Testing Devision it's always possible to allow them to wreck your HDD and recover the data as a Test procedure of their equipment but this isn't overly likely.

One 20 GIG HDD that had this done to it resulted in well over 200 GIG of recovered Data but as the expense is quite high most real people can not afford this procedure. The last time that I saw it done it was estimated that the cost of the Data Recovery was $356,000.00 AU that was stated in Court as the costs and added to the fine inflicted on the guilty party.

Actually I'm thinking about this the wrong way the Feds have the ability the break the Encryption as it can not be allowed in this country or the US for that matter till the Federal Government has the ability to break the Encryption. As you already have the encrypted data the Proper Authorities should find it quite easy to break the encryption and recover your data.

Now the real question is who do you know in the Federal Computer Crimes Division of whatever agency is in your area?

Col

by why me worry?

EFS uses public/private key cryptography to encrypt the files on your NTFS file system, which could be anything from 512 to 2048 bits. Without the private yet, your files are as good as locked forever. Trying to crack the encryption key is like trying to break into Fort Knox and getting out within 5 minutes...it simply cannot be done in a quick and painless manner. When you decided to format your hard drive, you blew away the only means (the private key) by which to retrieve the encrypted files. Microsoft is not lying to you or taunting you, as they are telling you the truth about EFS , because as its name implies, it is an encrypted file system. If EFS was easy to crack, it would be pointless to implement EFS to encrypt files and nobody would be using it. Nevertheless, most people don't use it because of the problems they can encounter, such as in your situation. Regarding the method to move the encrypted files to a FAT formatted partition, that would work, but you still need to provide the private key to budge the files from their encrypted location on the NTFS volume, so the problem still exists. As others have stated, you will first need to recover the data on your hard drive that you blew away by formatting it, and then proceed to access the encrypted data with the recovered private key. Are you willing to spend that kind of money to do this, risking that your HD may be destroyed in the process? If not, I suggest you lick your wounds and accept the fact that you f****d up bigtime and there is no cheap recourse to this.

by bhatnagar_nitin9

That's totally correct. As I already told that there is no way you can recover your data in this situation from your HDD. Better you understand the situation and accept this fact. Afterall, memories are stored in your mind :) and no one can beat human mind, not even the computers of todays world. Get solace in some good times :) and chin up, okay!

by thehebrew

It has been about 6 months since this, so I have sorta dealt with it. The thing I find hilarious, is that when I called Microsoft and finally got to talk to a TI there, he told me to find a good hacker........Microsoft suggested that I find a hacker, great stuff.

by bhatnagar_nitin9

the guys who comprises of Microsoft are the ones from among us and they are no different to us except that they are bound or better say adaptable to deal with the situations for the solution they only know of. I don't think that whoever written the code for windows would let you digg it just for the sake of some important things meant for inviduals like you. After all, it's all of us who has to know this fact and keep our toolbox ready for any such problems before going to the manufacturer.

by hal 9000

That the Governments of the world insist that there is a way to crack the encryption so that they can read any encrypted e-mails sent through the Telecommunications network.

So there is a Back Door into the EFS provided by M$, but for fairly obvious reasons they don't want to tell us what the way in when we need it.

Col

by durrsak_boy1

now i need the help of someone because i dont know to much of progrmaming and things like that but i have the same problem of THEHEBREW .. so can anybody tell me where exately does the CERTIFICATES stores itselfs .. so if i use a FILE recovery what do i need to recover that has in itself the CERTIFICATE to open the encrypted files .. i read about some SAM files but i dont have any idea

by groffg

Someone has probably answered this post already (I confess that I didn't read through all the replies!), but I believe EFS encryption is maintained when backing up using the built-in backup program (ntbackup.exe on Win2k and XP). This seems to be the case even when coping the backup file to a non-NTFS file system. The rationale for this decision makes sense (to preserve security of encrypted files), but it's certainly a frustration when one simply does not want to maintain the encryption of those files & worry about EFS certificate management.

Having said that, the original post did not explicitly mention that ntbackup.exe was being used, so this post may or may not be germane.

by hal 9000

http://tinyurl.com/5fwlw

All Home Users should also have to take an examination to make sure that they have both read this page and understand it as well before they can enable EFS in XP Pro or now Vista.

The number of times that people have asked this exact same question only to be told that they can not recover their files easily is unbelievable.

Of course this needs to be disabled on corporate machines so maybe if the Volume License Version didn't need the end users to log in and read the link then do an exam that would be the easy solution. It would also mean that the various companies also have the correct version of Windows installed on their corporate desktops as an added advantage. :D

Col

by jgoodman8

I dont know if you have ever used any data recovery tools, but I have successfully used On-track data recovery several times, even after a hdd has been completely formatted and re-imaged, I have been able to pull old files from the abyss. It may help get your old key back, it may not...just a suggestion.

by hal 9000

But if you are just unable to access your data that is open the Folder that it is in you need to Take Owner Ship of the Files by following the directions here

http://tinyurl.com/3aw7

If you have a Cloned Bootable HDD and need a copy of the Encryption Key you need to set up the Drive with the Key on it as a Bootable Drive and then follow the directions here to copy the Encryption Key

http://tinyurl.com/3cd8hf

Col

by pcproffsen

I did not have the exact scenario as you, I had an account that I apparently used to encrypt the "My Documents" folder. I was not aware that it was encrypted. Then I removed that user account and only had Administrator, renamed as Admin left as the only account on my Laptop.
After a while I discovered that a lot of files and folders in the Admin's "My Document" were encrypted... I had no idea why this happened and I could not decrypt them.
When I checked "information" about the files, it stated that the owner was the old account that I removed a while ago.

I tried a few ways that did not work, then I found the tool "Advanced EFS Data Recovery" from Elcomsoft, and it worked fine to restore my files and folders whitout encryption :)
But it might not work if you dont know the name and password of the account used to encrypt the files, AEFSDR scans for encrypted folders and files and keys, then it asks for the username and password, if you dont have that it probably wont work....

by deathscythehell999

If you've read the above relies you should know that he already tried that approach and it was useless. AEFSDR only works if the HDD in question has not been reformatted and in this case it has. I'm more or less in the same situation as thehebrew except in my case it's roughly a terabyte external HDD that has been encrypted. So all in all thehebrew's situation isnt nearly as bad.

by pcproffsen

Yes I read the other replies.
I only wanted to tell that AEFSDR worked for me (even if i did not reformat).
If the drive is formated a good data recovery software can be used to get the needed files, but that has to be done before any new data is overwriting the info. (That was also mentioned in some other replies)
Some data recovery software claims that even overwritten files can be recovered, but i think the chance is very small.

This discussion is closed to new replies.