General discussion


Need help with EFS encrypted files!

By thehebrew ·
So I have efs encyption on for my hard drive, then i reformatted. So ibacked up all my videos, music, and 10 years worth of family photos on my external hard drive. I reformat, get all my programs and everything together and then go to my external hard drive to get the files, AND THEY ARE STILL ENCRYPTED!!!!!! windows forgot to take the flippin' encryption off the files. I talk to microsoft and the guy on the phone freakin' tells me to find a good! I have searched ALL of the internet and have found that if i move the files to a hard drive that is formatted to FAT the files lose all encryption. But i can't move the dam files!!!! I have tried all the EFS recovery programs but they only get the original key and that drive has already been formatted. SOMEONE, FOR GOD SAKES PLEASE PLEASE PLEASE HELP ME!!!!! I have years and years of family photos and hundreds of dollars worth of music that i can't access. I can even see all the thumbnails to the pictures, MICROSOFT IS TAUNTING ME!!!!!!!

This conversation is currently closed to new comments.

56 total posts (Page 4 of 6)   Prev   02 | 03 | 04 | 05 | 06   Next
Thread display: Collapse - | Expand +

All Comments

Collapse -

Try this, works for me

by pc21geek In reply to Need help with EFS encryp ...

Follow the instructions :
1. Login as Administrator

2. Go to Start/Run and type in cmd and click OK.

At the prompt type cipher /r:Eagent and press enter

This prompt will then display:

Please type in the password to protect your .PFX file:

Type in your Administrator password
Re-confirm your Administrator password

The prompt will then display

Your .CER file was created successfully.
Your .PFX file was created successfully.

The Eagent.cer and Eagent.pfx files will be saved in the current directory that is shown at the command prompt. Example: The command prompt displays C:\Documents and Settings\admin> the two files are saved in the admin folder. (For security concerns, you should house the two files in your Administrator folder or on a floppy disk).

3. Go to Start/Run and type in certmgr.msc and click OK. This will launch the Certificates Manager. Navigate to Personal and right click on the folder and select All Tasks/Import. The Certificate Import Wizard will appear. Click Next. Browse to the C:\Documents and Settings\admin folder. In the Open dialog box, change the Files of Type (at the bottom) to personal Information Exchange (*.pfx,*.P12). Select the file Eagent.pfx and click Open. Click Next. Type in your Administrator password (leave the two checkboxes blank) and click Next. Make sure the Radio button is active for the first option (Automatically select the certificate store based on the type of certifcate). Click Next. Click Finish. (You'll receive a message that the import was successful). To confirm the import, close Certificates Manager and re-open it. Expand the Personal folder and you will see a new subfolder labeled Certificates. Expand that folder and you will see the new entry in the right side column. Close Certificate Manager.

4. Go to Start/Run and type in secpol.msc and click OK. This will launch the Local Security Policy. Expand the Public Key Policies folder and then right click on the Encrypted File System subfolder and select Add Data Recovery Agent... The Wizard will then display. Click Next. Click the Browse Folders... button. Browse to the C:\Documents and Settings\admin folder. Select the Eagent.cer file and click Open. (The wizard will display the status User_Unknown. That's ok). Click Next. Click Finish. You will see a new entry in the right side column. Close the Local Security Policy.

You, the Administrator are now configured as the default Recovery Agent for All Encrypted files on the Local Machine.

To Recover Encrypted files:

Scenario #1

If you have completed the above steps BEFORE an existing user encrypted his/her files, you can log in to your Administrator account and navigate to the encrypted file(s). Double click on the file(s) to view the contents.

Scenario #2

If you have completed the above steps AFTER an existing user has already encrypted his/her files, you must login to the applicable User's User Account and then immediately logout. Next, login to your Administrator account and navigate to the encrypted file(s). Double click on the file(s) to view the contents.


Do not Delete or Rename a User's account from which will want to Recover the Encrypted Files. You will not be able to de-crypt the files using the steps outlined above.

Collapse -

just tried it with no luck

by thehebrew In reply to Try this, works for me

You do realize that these files come encrypted from a hard drive and user account that was formatted over. thank you for trying to help but I tried it and it didn't work. I only have one account on my computer right now and uses the same name as the old account did. I did notice though when I was looking at the files that when I click the "details" button next to "encrypt" that it does have the thumb print of the old account that has access to it. But i can't remove it or add a new account. Thanx

Collapse -

O dear !

by bhatnagar_nitin In reply to Need help with EFS encryp ...

If you really formatted your hard drive with all your files encrypted in microsoft windows, then there is no way out to retrieve them from windows operating system. Infact, no programme out there in the market can retrieve them which are based on microsoft technology.
There is only one way which I can see is to recover your files using Recovery agent from EFS. But for that you need to have your private key which was created when you first encrypted your file. But since you have formatted your hard drive, your private key is also now lost and no way you can retrieve it. I had lots of, lots of problem with this EFS in Microsoft. Unless you are an expert on EFS, you should not use it.
Now, thinking of recovering your private key from your formatted hard drive, you should better look for such programmes who can retrieve data from formatted hard disk, which, unfortunately I don't think even exist. Your only bet is to catch Microsoft Corporation in order to get them back for you.

For your readings, you may want to look at the following articles:


Collapse -


by thehebrew In reply to O dear !

O dear is right, now you're on track to my situation. The hard drive I formatted has been long written over since, and in fact I completely sweep'd the drive before so there's no way in **** it was there afterwards. That why I am looking for a hacker, and its just some priceless things I need, if the hacker wants to keep copies of family photos and high school/ college papers, he can, i don't care. I tried Microsoft but they won't even take my situation seriously, all I get is crap tech support. Thanx for trying to help.

Collapse -

Why did you use EFS in the first place?

by NOW LEFT TR In reply to Need help with EFS encryp ...

What was the reason exactly?

The whole mess you are in now is what EFS was designed to do.

Best bet would be to find a disk recovery shop / site and post the disk away. Hope you have nothing illegal on it.

Collapse -

As the HDD has been wiped formatted and so on

by HAL 9000 Moderator In reply to Why did you use EFS in th ...

You would need a Forensic Data Recovery Service like that used by the Feds to recover every layer of data off the HDD. This results in the destruction of the HDD and the loss of lots of money.

Besides the Government Agencies there are only 2 places that I know of that are capable of doing this type of work and that is XWays in Germany and On Track as both can dismantle the HDD coat the platters and then read directly off the platters. Though this is really expensive a a bit extreme for something as silly as using a Free M$ provided so called Security Tool.

Maybe it's M$ way of keeping the Data Recovery Houses in Business.


Collapse -

I Wish

by thehebrew In reply to As the HDD has been wiped ...

If i thought that would work I would do it, but the fact is, is that an hour after I wiped the hard drive, I reinstalled Windows onto it and used it for a couple days before realizing that the data was encrypted (I don't look at photos and old documents all the time.) By then the hard drive had been written many times over, and I'm actually using the same drive right now. My bad, i know.

Collapse -

by HAL 9000 Moderator In reply to I Wish

TR & it's Double Posts.

Collapse -

Well it's is possible to recover the Encryption keys

by HAL 9000 Moderator In reply to I Wish

But it involves destroying the HDD and then coating the platters with some green goop and allowing them to dry off then placing them into a special machine and read each layer of data. Because nothing every works perfectly you do not get a bunch of 0 & 1 but some minor differences with each layer.

The down side is that it's time consuming and EXPENSIVE as Hell. Of course if you know someone within the Federal Computer Crimes Testing Devision it's always possible to allow them to wreck your HDD and recover the data as a Test procedure of their equipment but this isn't overly likely.

One 20 GIG HDD that had this done to it resulted in well over 200 GIG of recovered Data but as the expense is quite high most real people can not afford this procedure. The last time that I saw it done it was estimated that the cost of the Data Recovery was $356,000.00 AU that was stated in Court as the costs and added to the fine inflicted on the guilty party.

Actually I'm thinking about this the wrong way the Feds have the ability the break the Encryption as it can not be allowed in this country or the US for that matter till the Federal Government has the ability to break the Encryption. As you already have the encrypted data the Proper Authorities should find it quite easy to break the encryption and recover your data.

Now the real question is who do you know in the Federal Computer Crimes Division of whatever agency is in your area?


Collapse -


by thehebrew In reply to Well it's is possible to ...

No one, but I'm a people person. :)

Back to Community Forum
56 total posts (Page 4 of 6)   Prev   02 | 03 | 04 | 05 | 06   Next

Related Discussions

Related Forums