56 replies
by zlitocook
Can not get passed the encryption after a few weeks let me know. If you don?t mind letting some one else seeing your files, I may be able to decrypt them for you.
But first you should have decrypted the files before formatting because the key was on the drive and under your profile. There are programs out there that will do this but most that you D/L will also have Trojans or virus attached to them. You could also send it to a data recovery company. But it will cost and they may ether not be able to help or destroy the data.
Try the UDCD and see if you can move the files to a second drive with fat32 or load Kloppix or another Linux distro on a second drive and move them from there.
I don?t like doing this and have to stay away from it, but if you don?t get any where let me know.
But there are alot of great people here and they might have a better thought about it.
by jdclyde
boot to a live distro of linux. It will completely ignore the windows security.
COPY your data to another drive. This gives you multiple attempts to screw it up.... I mean to unencrypt it. :D
by techexec2
YOU NEED TO UNDERSTAND YOUR SITUATION
You need to understand your situation.
[i]"I have searched ALL of the internet and have found that if i move the files to a hard drive that is formatted to FAT the files lose all encryption."[/i]
This is true, but only if you did that BEFORE you reformatted the original hard drive. The encryption key was stored on your original hard drive. All you can do now is copy the encrypted version around.
Your situation now: To decrypt the files now, you must BREAK the encryption. And, the encryption is designed to be difficult to break. In effect, when you chose to use encryption, you chose to put a powerful lock on your files. Now, you must break your own powerful lock.
ANOTHER IDEA
Another idea: If you just freshly reformatted the original hard drive and have not done anything else to it, you might (desperately) try to use a utility to recover that drive. If this were successful, you could decrypt your files.
LESSONS FROM THIS
This may be a hard lesson for you. Having just ONE copy of your system and files is dangerous. If the hardware fails, the software fails, or the user fails (i.e. makes an error as in this case), that one copy is lost. So, the thing to learn from this is that you must have multiple backups to protect yourself.
Good luck to you.
edit: spelling
by thehebrew
by techexec2
You're still a little off-target:
-----
[i]"I can change the ownership like suggested"[/i]
Changing ownership is not going to help you. The problem is that your data is scrambled by the encryption and you no longer have the key.
-----
[i]"Do i have to restart after changing ownership?"[/i]
No. But as above, changing ownership is not the problem.
-----
[i]"I think I'll try running a Linux distro off a thumb drive and then copy the files to the thumb drive."[/i]
Running Linux is not going to help either. You need to decrypt the data inside the files.
-----
[i]"once I have them on the FAT32 drive how do I get the encryption off"[/i]
You must BREAK the encryption. You must CRACK your own encryption.
-----
[i]"everyone else just says I'm stupid"[/i]
Did I forget to say you were stoopid? :-). Sorry about that :^0.
Everyone has done something stoopid before. Even me. Even JD. JD will deny this. You watch. :^0
-----
Good luck to you.
by jdclyde
The first thing he should try is to reclaim the permissions. That is why I suggested the "COPY" option.
As he doesn't have permissions, how does he know if it is still encrypted?
He should try to reclaim them first (which he would have to do anyways before he could decrypt) and then get back to us. :D
by douahe
I was reading your post about cracking EFS encryption. Do you have some suggestions to how to go about cracking the encryption? My situation is a little different in a this post "Need help with EFS encrypted files!". I clone my hard drives so I have all the same information. When restoring my hd from the clone, I can access all my files that are on that hd. But, I also have a significant number of encrypted documents on an external hd. The files on the external hd I cannot access. The files were all encrypted at the same time as the ones on the hd. Do you have any suggestions on how to gain access to my files? Thank you for your help.
Helgi
by techexec2
JD's reply to me prompts some questions. In your posts you have said some things that appear to contradict each other. So, it's really not completely clear where things stand.
-----
Regarding:
[i]"when ever I moved file/folders onto my external drive it always used to take the encryption off"[/i]
Are you saying you are SURE that the files on the external hard drive were not encrypted before you reformatted the system HDD?
If the answer is "yes", then they are STILL not encrypted and security is locking you out, not encryption. In that case, all you need to do is reclaim ownership of the files on the new system you installed.
-----
Regarding:
[i]"I can change the ownership like suggested"[/i]
Have you already changed ownership successfully? Or, not? I thought this meant you had already reclaimed access but were still being denied access.
-----
Regarding:
[i]It just gives me an access denied error message.[/i]
Please provide the exact error message text. Recreate the problem if you didn't write it down the first time. We must know the exact error message in order to understand what is going on.
-----
I have more to say but I'll wait for your reply to this.
edit: clarity
by thehebrew
by thehebrew
by hal 9000
Could recover or rebuild the last Bootable HDD but these are not cheap and it generally cheaper to just break the encryption.
Col
by techexec2
This is what you're up against.
From reference (1):
[i]"The process of enabling EFS is quick and simple, but the consequences of losing your private key can be catastrophic. If your user account is damaged or deleted then you will almost certainly lose the decryption key and your data will be effectively lost. To avoid this you should backup your personal encryption certificate immediately after the service has been enabled."[/i]
EFS RECOVERY TOOL
I have no experience with this tool, but it looks pretty good. It's called "Advanced EFS Data Recovery" (7). They say [i]"With Advanced AEFS Data Recovery, protected files can decrypted even in a case when the system is not bootable and so you cannot log on, and/or some encryption keys (private or master) have been tampered."[/i] and [i]"The latest addition to ElcomSoft's family of password recovery software allows business managers to deal with lost and destroyed encryption keys"[/i].
Caution: This company, Elcomsoft, is based in Moscow, Russia, and appears to be highly competent. I don't want to disparage our Russian friends. I like Russia! I cannot say there is any more lawlessness in Russia than in the USA. But, I can say that it will be more difficult for a USA person to get justice if the perpetrator is in Russia. Proceed as you deem appropriate.
IF YOU ARE SUCCESSFUL
I you successfully crack your EFS encryption and recover your data, please post back and let us know what you did and how well it worked. We may need to know one day. Thanks.
REFERENCES
(1) Windows XP Pro: Using File Encryption ? part 1
http://www.practicalpc.co.uk/computing/windows/xpencrypt1.htm
(2) Windows XP Pro: Using File Encryption ? part 2
http://www.practicalpc.co.uk/computing/windows/xpencrypt2.htm
(3) Windows XP Pro: Using File Encryption ? part 3
http://www.practicalpc.co.uk/computing/windows/xpencrypt3.htm
(4) Windows XP Pro: Using File Encryption ? part 4
http://www.practicalpc.co.uk/computing/windows/xpencrypt4.htm
(5) Windows XP Pro: Using File Encryption ? part 5
http://www.practicalpc.co.uk/computing/windows/xpencrypt5.htm
(6) Data Protection (EFS on Windows 2000)
http://www.microsoft.com/technet/security/prodtech/windows2000/w2kccadm/dataprot/w2kadm21.mspx
(7) Advanced EFS Data Recovery
http://www.crackpassword.com/products/prs/mswin/
edit: caution about Elcomsoft
by thehebrew
by tig2
HOW did you format? Quick format? Complete format?
In a complete format, you pretty much clobber everything. Can things be recovered? Yes but generally only fragments and then only with a pretty powerful tool. But it can happen- which is why when you dispose of HDDs, you have to run a kill disk cycle- completely overwrite all of the drive, generally with multipass ones and zeros.
All Quick Format does is wax the Boot Sector and the directory structure. It is entirely possible to use a recovery tool to get at data that may not have been overwritten by the OS footprint.
I hope you used Quick Format...
Edited because I must
by techexec2
I thought he already reclaimed access and was failing to get access due to the encryption. Perhaps not. His language is not entirely clear.
Sometimes it is a matter of "reading between the lines". And, you might have done a better job of it here :D. We'll see what he says.
by thehebrew
by hal 9000
And belatedly here is what you should have done to save your Encryption key it a good lesson none the less though a bit of a nasty one as well.
Now what many people are unaware of is that before any Encryption System can be released the Government [b]Must Have[/b] the ability to break the encryption so they can recover the data possibly for evidence in Court Proceedings so while it's hard for the average Joe to do there is a [b]Back Door Available.[/b]
When you use Encryption the files stay encrypted whenever you move them about and even if you had of backed up all of your Data the Files would still be encrypted no matter the format of the drive that they where copied to even a Nix Drive would store them as Encrypted from the original Windows Source. The reason that you could read these files is that you where working off the original computer with the [b]Encryption Key[/b] so the encryption was effectively Transparent to you.
Now the easy answer to your current dilemma is to approach someone working for the [b]Federal Crime Authorities[/b] and they'll be able to break the encryption in a matter of seconds but for some strange reason they don't hand out this information as it's fairly useful to them again for fairly obvious reasons.
There is another possibility here [b]Get My Data Back[/b] is a company which was setup by several retired [b]Fed Data Recovery Specialists[/b] so they have the knowledge and ability to break the encryption though they may not have the motivation but are worth a try here
Actually the person from MS gave you some very good advice as any decent Hacker will know the Back Door into the Encryption bypassing method and will be able to recover your data and most likely do it for free into the bargain though as they break things for fun you never actually know if they'll keep a copy and do with it as they please. However you may find someone who wants the [b]Bragging Rights[/b] who is interested in performing the recovery.
Now I've never actually broken the encryption on any product to recover data but it is in Theory possible to perform I would recommend starting [b]Hacking for Dummies[/b] as a starting point and work forward from there.
As the data is already scrambled I don't think that using something like Knoppix will actually do anything but keep coping garbage admittedly a perfect copy of the garbage but garbage none the less.
Now if you had performed a Backup and at the same time backed up the Encryption Key which is a [b]Must Do[/b] item you wouldn't be in the predicament that you are in now as you could use the Encryption Key to recover your data and turn it from Garbage to readable Data once again. The fact that you have 10 years worth of Data Encrypted I think is marvellous and borders on the unbelievable as that's a long time for any computer program to be running and even longer for a computer as you must have changed it at least once if not more in the meantime. Do you still have the working old computer? If you do the [b]Encryption Key[/b] will be there and will have been transfered along with your data so you could recover it from there quite easily and have your data back to normal easily.
While it is a [b]Dumb Thing to do[/b] it is also a fairly common thing to do by many who don't know any better and think that they are making their system more secure. [b]The Really Dumb Thing[/b] that you have done here is not to research your procedures for a proper Backup and you haven't been keeping any proper Backup in place which is something that you should [b]Change Immediately![/b]
If you wish to use any form of [b]Encryption[/b] you should be at the very least using an [b]Image of the Boot Drive[/b] to restore from as that keeps everything that you need in place and gives you at only a small cost an easy and fast recovery method.
Whenever I run into domestic situations who have turned on the Encryption I immediately save their data and turn off the encryption and I also do this even in small business that I do work for as the costs involved in recovering the encryption key is just so expensive as not to be worth the cost in most cases.
This reminds me of a One Man Show who I built a computer for and told him to Save All His Data regularly. Well he insisted that he was backing up his data and when the HDD failed an old one from his previous computer as he was too cheap to spring for the $100.00 drive he lost all of his data but for the Company Financial Records which was what he was religiously backing up after every entry session. He didn't seem to grasp that he had other data on the drive that he wanted to keep. But on the other side of the coin he did save about $25.00 when I eventually had to fit a new HDD to the computer and he passed up the opportunity to get one of the data recovery houses to recover all his data as it was only going to cost at a minimum of 3K and possibly more to get all his photos and the like back.
So the easy answer is if you know someone who works for the Feds who has access to the [b]Computer Crimes Side of things[/b] you can ask them to make your Encrypted files usable, or you can start reading up on breaking Encryption Keys and find some of the tools that are used to hack these Keys. If you get lucky you may even find the back Door into the Files and recover them all. But I wouldn't be holding my breath waiting for a [b]Lucky Break.[/b]
By the way don't feel bad about doing a [b]Dumb Thing[/b] as we all manage to do [b]Dumb Things[/b] during our lives my worst mistake was to start working with computers and it's something that I've never recovered from though a close second would be using MS Software in the form of OS's. :)
Col
by thehebrew
by tig2
Google is your friend. Don't just try strings that you think will work, try a variety of strings.
Learn the following mantra, keep it wholly (intentional mis-spelling) "I will back up my keys, I will back up my keys, I will back up my keys". Learn it, Live it, Love it.
If you want to encrypt data and it does not contain credit data, personal data, banking data, ets, burn a copy (unencrypted) to disk and hide it where you can find it.
NEVER toast your box until you have first VERIFIED that your backup is good- preferably on another system.
I know that you know all this. I am just sad for you. Data loss is not good and it sounds like you have been trying hard to get this dealt with.
Good luck!
by danlm
What I do encrypt is my thumb drive. All of the things that I think I need at all costs are stored there. Including keys for ssh. This way, when I'm done with that stuff. I unplug it.
I only put on my main drive programs, the rest goes to partitions or the file server. And that is a UNIX box with UNIX file organization.
But, I know the feeling. I had that box hacked once and they deleted everything on me. Maybe that's why I'm so paranoid about ssh, keys, and stuff.
I hope you get your stuff back.
Dan
by hal 9000
Did you try reading this HDD on another computer to make sure that you could actually read your files?
I very much doubt that the Encryption was ever removed when you copied the files to an external storage device it's just that because you used the same computer to read them the Encryption became Transparent to your and you forgot about it.
Even MS accepts [b]Well Actually Warns you[/b] that when you copy [b]Encrypted Files[/b] they remain encrypted. So I can not see how the Encryption Would be removed just by a simple Data Copy.
Even on a Big Business/Government machines where Data Encryption is a [b]Must Use[/b] the files always remain encrypted no matter where they are copied to or how that they are copied unless it is in plain text format.
Once you Encrypt files they stay that way till you remove the encryption and there is no way around this.
[b]Just one thing here you'll at the very least need to make another copy of these files before attacking them with hacking tools, make sure that you always have an untouched copy available to refer back to should something go wrong and you loose the original data. As you already have the files on an External Storage Device copy them from there and then unplug that device and place it in a safe place where it can not be wiped as you may need the data on it at some stage in the future. [i]This is really Important![/i][/b] Once you have your data readable you can then proceed to wipe the Encrypted Files but don't consider doing this before you have usable data present. This may require another External Storage Device to be purchased but it's needed as you never attack the original data if you make a mistake you'll loose everything with [b]No Hope Of Recovery.[/b]
Col
by thehebrew
by hal 9000
Though from everything that I've read in the Public Domain you need at least the original OS to unlock the encrypted files which in your case no longer exists so I'm not sure if any of these will be of any use to you.
Knoppix STD is very good as a security tool on a non working Windows Install but it relies on the original keys being present so I would rule that one out straight away.
But there may be something else useful on that page or at the very least a possible link to somewhere else that may prove useful.
Col
by thehebrew
by awrjunk47
by thehebrew
by adiabloa
well same problem happened to me
and the thing is i really need to get these files back, if you know any site that can do this but maybe for a cost or anything plz show me
or if you think you can do it and you do succes to do it i'll pay you 100$ i know its not alot but im a poor student and we students have a hardtime already as it is ... so be a doll and help me out ...
by pc21geek
Follow the instructions :
1. Login as Administrator
2. Go to Start/Run and type in cmd and click OK.
At the prompt type cipher /r:Eagent and press enter
This prompt will then display:
Please type in the password to protect your .PFX file:
Type in your Administrator password
Re-confirm your Administrator password
The prompt will then display
Your .CER file was created successfully.
Your .PFX file was created successfully.
The Eagent.cer and Eagent.pfx files will be saved in the current directory that is shown at the command prompt. Example: The command prompt displays C:\Documents and Settings\admin> the two files are saved in the admin folder. (For security concerns, you should house the two files in your Administrator folder or on a floppy disk).
3. Go to Start/Run and type in certmgr.msc and click OK. This will launch the Certificates Manager. Navigate to Personal and right click on the folder and select All Tasks/Import. The Certificate Import Wizard will appear. Click Next. Browse to the C:\Documents and Settings\admin folder. In the Open dialog box, change the Files of Type (at the bottom) to personal Information Exchange (*.pfx,*.P12). Select the file Eagent.pfx and click Open. Click Next. Type in your Administrator password (leave the two checkboxes blank) and click Next. Make sure the Radio button is active for the first option (Automatically select the certificate store based on the type of certifcate). Click Next. Click Finish. (You'll receive a message that the import was successful). To confirm the import, close Certificates Manager and re-open it. Expand the Personal folder and you will see a new subfolder labeled Certificates. Expand that folder and you will see the new entry in the right side column. Close Certificate Manager.
4. Go to Start/Run and type in secpol.msc and click OK. This will launch the Local Security Policy. Expand the Public Key Policies folder and then right click on the Encrypted File System subfolder and select Add Data Recovery Agent... The Wizard will then display. Click Next. Click the Browse Folders... button. Browse to the C:\Documents and Settings\admin folder. Select the Eagent.cer file and click Open. (The wizard will display the status User_Unknown. That's ok). Click Next. Click Finish. You will see a new entry in the right side column. Close the Local Security Policy.
You, the Administrator are now configured as the default Recovery Agent for All Encrypted files on the Local Machine.
To Recover Encrypted files:
Scenario #1
If you have completed the above steps BEFORE an existing user encrypted his/her files, you can log in to your Administrator account and navigate to the encrypted file(s). Double click on the file(s) to view the contents.
Scenario #2
If you have completed the above steps AFTER an existing user has already encrypted his/her files, you must login to the applicable User's User Account and then immediately logout. Next, login to your Administrator account and navigate to the encrypted file(s). Double click on the file(s) to view the contents.
*Warning
Do not Delete or Rename a User's account from which will want to Recover the Encrypted Files. You will not be able to de-crypt the files using the steps outlined above.
by thehebrew
by thehebrew
If you really formatted your hard drive with all your files encrypted in microsoft windows, then there is no way out to retrieve them from windows operating system. Infact, no programme out there in the market can retrieve them which are based on microsoft technology.
There is only one way which I can see is to recover your files using Recovery agent from EFS. But for that you need to have your private key which was created when you first encrypted your file. But since you have formatted your hard drive, your private key is also now lost and no way you can retrieve it. I had lots of, lots of problem with this EFS in Microsoft. Unless you are an expert on EFS, you should not use it.
Now, thinking of recovering your private key from your formatted hard drive, you should better look for such programmes who can retrieve data from formatted hard disk, which, unfortunately I don't think even exist. Your only bet is to catch Microsoft Corporation in order to get them back for you.
For your readings, you may want to look at the following articles:
http://www.atlguide2000.com/links/index.php?act=cat&cat=183
and
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/cryptfs.mspx
by thehebrew
by now left tr
What was the reason exactly?
The whole mess you are in now is what EFS was designed to do.
Best bet would be to find a disk recovery shop / site and post the disk away. Hope you have nothing illegal on it.
by hal 9000
You would need a Forensic Data Recovery Service like that used by the Feds to recover every layer of data off the HDD. This results in the destruction of the HDD and the loss of lots of money.
Besides the Government Agencies there are only 2 places that I know of that are capable of doing this type of work and that is XWays in Germany and On Track as both can dismantle the HDD coat the platters and then read directly off the platters. Though this is really expensive a a bit extreme for something as silly as using a Free M$ provided so called Security Tool.
Maybe it's M$ way of keeping the Data Recovery Houses in Business.
Col
by thehebrew
by thehebrew
by now left tr
you need to understand the past motive.
To answer your question - a recent TV advert informs me that the answer is to get 'Quick & Cheap Car Insurance'.
by hal 9000
by hal 9000
But it involves destroying the HDD and then coating the platters with some green goop and allowing them to dry off then placing them into a special machine and read each layer of data. Because nothing every works perfectly you do not get a bunch of 0 & 1 but some minor differences with each layer.
The down side is that it's time consuming and [b]EXPENSIVE as Hell.[/b] Of course if you know someone within the Federal Computer Crimes Testing Devision it's always possible to allow them to wreck your HDD and recover the data as a Test procedure of their equipment but this isn't overly likely.
One 20 GIG HDD that had this done to it resulted in well over 200 GIG of recovered Data but as the expense is quite high most real people can not afford this procedure. The last time that I saw it done it was estimated that the cost of the Data Recovery was $356,000.00 AU that was stated in Court as the costs and added to the fine inflicted on the guilty party.
Actually I'm thinking about this the wrong way the Feds have the ability the break the Encryption as it can not be allowed in this country or the US for that matter till the Federal Government has the ability to break the Encryption. As you already have the encrypted data the Proper Authorities should find it quite easy to break the encryption and recover your data.
Now the real question is who do you know in the Federal Computer Crimes Division of whatever agency is in your area?
Col
by thehebrew
by thehebrew
by hal 9000
That the Governments of the world insist that there is a way to crack the encryption so that they can read any encrypted e-mails sent through the Telecommunications network.
So there is a Back Door into the EFS provided by M$, but for fairly obvious reasons they don't want to tell us what the way in when we need it.
Col
by durrsak_boy1
by hal 9000
What you are asking is how to backup the Encryption Key if that's your question the answer is here though you may have to dig around in the M$ Knowledge Base a bit
Col
by groffg
Someone has probably answered this post already (I confess that I didn't read through all the replies!), but I believe EFS encryption is maintained when backing up using the built-in backup program (ntbackup.exe on Win2k and XP). This seems to be the case even when coping the backup file to a non-NTFS file system. The rationale for this decision makes sense (to preserve security of encrypted files), but it's certainly a frustration when one simply does not want to maintain the encryption of those files & worry about EFS certificate management.
Having said that, the original post did not explicitly mention that ntbackup.exe was being used, so this post may or may not be germane.
by hal 9000
All Home Users should also have to take an examination to make sure that they have both read this page and understand it as well before they can enable EFS in XP Pro or now Vista.
The number of times that people have asked this exact same question only to be told that they can not recover their files easily is unbelievable.
Of course this needs to be disabled on corporate machines so maybe if the Volume License Version didn't need the end users to log in and read the link then do an exam that would be the easy solution. It would also mean that the various companies also have the correct version of Windows installed on their corporate desktops as an added advantage. :D
Col
by jgoodman8
by hal 9000
But if you are just unable to access your data that is open the Folder that it is in you need to Take Owner Ship of the Files by following the directions here
If you have a Cloned Bootable HDD and need a copy of the Encryption Key you need to set up the Drive with the Key on it as a Bootable Drive and then follow the directions here to copy the Encryption Key
Col
by pcproffsen
I did not have the exact scenario as you, I had an account that I apparently used to encrypt the "My Documents" folder. I was not aware that it was encrypted. Then I removed that user account and only had Administrator, renamed as Admin left as the only account on my Laptop.
After a while I discovered that a lot of files and folders in the Admin's "My Document" were encrypted... I had no idea why this happened and I could not decrypt them.
When I checked "information" about the files, it stated that the owner was the old account that I removed a while ago.
I tried a few ways that did not work, then I found the tool "Advanced EFS Data Recovery" from Elcomsoft, and it worked fine to restore my files and folders whitout encryption :)
But it might not work if you dont know the name and password of the account used to encrypt the files, AEFSDR scans for encrypted folders and files and keys, then it asks for the username and password, if you dont have that it probably wont work....
by pcproffsen
Yes I read the other replies.
I only wanted to tell that AEFSDR worked for me (even if i did not reformat).
If the drive is formated a good data recovery software can be used to get the needed files, but that has to be done before any new data is overwriting the info. (That was also mentioned in some other replies)
Some data recovery software claims that even overwritten files can be recovered, but i think the chance is very small.
This discussion is closed to new replies.
Trending Community archive posts
Sort by Trending