Question Locked

Retreiving keys for the EFS system.

0 helpful
5 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I was using Winodws XP with the admin rights. And have used the NTFS encryption to encrypt files on local HDD as well as external.
Now that the system is not booting up - I have replace the HDD form the system and connect the olh HDD though USB port.
The drive is browsable. And I believe atleast my user account will be saved.

My base concern is to recover the encryption key form the systemand install it on the new OS loaded.

Regarding this -

1) The error while booting is " system32/ config/system file missing or corrupted" I have been advised to replace the same files with theones in the i386 folder. Will this effect my user account or my password. OR shoulf I refrain form trying this.

2) If there is a way to take image of the partition so that we can try to experiment on the HDD and in case of any problem we can restore back.

3) If there is a way to access my previous user account profile and load it onto my new system - will it solve the problem.

4) If the file is located at some particular system folder - is there any way to just copy and paste those files

5) The MS site talks about Recovery agent - can we find out if there is any recovery agent created for my profile and then again - where to look for the keys.

6) Where to look for the system information - computer name, adminstrator , user name, display name - so that I can reload windws onto another HDD with same settings.

7) I had symantec client security installed as a policy to access internet through LAN. Will this effect my status as administrator and will this effect the possible recovry of the keys.

5 replies

by older mycroft

For instance your Point #6 says:

"[i]Where to look for the system information - computer name, adminstrator , user name, display name - so that I can reload windws onto another HDD with same settings.[/i]"

Maybe I'm getting confused, but didn't you post that this system was being used by you, with Admin rights? If so, why do you not know this information?

by oh smeg

Your system is no longer loading and is spitting up errors. You have XP Pro and are using EFS and now need to get back in without destroying your EFS Key so you can access your data. You then go on to list several possible Fixes and want to know if any of these will destroy your Encryption Key as that will trash your Data.

Easy Answer is to plug your External Drive into another XP Pro computer and recover your Encryption Key if you actually Backed it up.

http://tinyurl.com/3cd8hf

Simerally you could remove the HDD and fit it to the USB Caddy and try the above directions to recover your Encryption Key. I'm not sure if it will work but it's worth a Try as M$ only advice is to Fund a Good Hacker/Cracker to break the Encryption. That's not really an option so try the above directions first on another Computer where you are logged in with Admin Rights

Now in answer to the rest of your Questions

[i]1) The error while booting is " system32/ config/system file missing or corrupted" I have been advised to replace the same files with theones in the i386 folder. Will this effect my user account or my password. OR shoulf I refrain form trying this.[/i]

Replacing this file shouldn't have any effect on the Encryption Key but as this is Windows the Really Important words above are [b]Should Not[/b] anything is possible with Windows.

[i]2) If there is a way to take image of the partition so that we can try to experiment on the HDD and in case of any problem we can restore back.[/i]

Yes either Norton's Ghost or Acros True Image can do this but if required the Original Copy needs to be available just in case things go wrong.

[i]3) If there is a way to access my previous user account profile and load it onto my new system - will it solve the problem.[/i]

You can fit the HDD to a USB Caddy and access your Drive from another XP Pro computer or you can fit another HDD to yours and install XP Pro to that and work on your Original HDD but you need to be extremely careful as any changes that you make could make the situation worse. You will also most likely need to Take Ownership of your Files by following the directions here

http://tinyurl.com/3aw7

[i]4) If the file is located at some particular system folder - is there any way to just copy and paste those files[/i]

You can try fitting the HDD to a external Caddy and copy your Files to another HDD. I'm not sure if coping the Encryption Key will actually work but it's worth a try. I've never been brave enough not to backup the Encryption Key so this is something that I've never tried to do.

[i]5) The MS site talks about Recovery agent - can we find out if there is any recovery agent created for my profile and then again - where to look for the keys.[/i]

The system needs to be working to achieve this so try replacing the corrupted Files as the Windows Loader spits up errors.

[i]6) Where to look for the system information - computer name, adminstrator , user name, display name - so that I can reload windws onto another HDD with same settings.[/i]

Not an option here as any attempt to reinstall Windows will result in th Total Destruction of the Encryption Key and total loss of your Data.

[i]7) I had symantec client security installed as a policy to access internet through LAN. Will this effect my status as administrator and will this effect the possible recovry of the keys.[/i]

Shouldn't affect anything but again the Operative Words Is [b]Shouldn't.[/b]

The easy solution is to remove the HDD fit a new/Different one and install XP Pro to that and then follow the Instructions to mount your Encryption Key so you can access your Data. And Don't backup or Save Encrypted Copies of your Data. If you computer dies and you buy a new one Vista can not access XP encrypted Files so they will be lost permanently with little chance/no of recovery.

A data recovery House can always crack the Encryption but it's not cheap but if the Data is Valuable this may be the best option. If you mess with the Drive you are increasing the chances of not being able to recover your Data so it may be worthwhile contacting a Data Recovery House and following their Directions here.

Some More M$ Links that may prove useful

How to recover from a Corrupt Registry in XP

http://tinyurl.com/4y24g

How to use the File Ownership Script Tool

http://tinyurl.com/47hh9

How you proceed from here Depends on the Data Stored. If you have everything Backed up and not the Encryption Key I would be looking at Cloning the Affected HDD and working with the Clone so that nothing is done to the Original Drive.

The main reason that EFS isn't a good alternative is that when something breaks the ability to recover is very limited great if you work at a bank and don't store any Important Data on the Computer but really Lousy to do if you rely on EFS to protect your Data from everyone but you as it has been known to protect it from everyone regardless of who attempts to gain access.

[i]Edited to Add[/i] You can try the Emergency Boot CD as that may help here

http://tinyurl.com/2q6n95

But if the Data is really important I would have a Clone of the Drive before starting to proceed with anything.

I hope the above is some use to you.

Col

by amitpjjain

IT was really helpful.

But I havenot taken any prior backup of the encryption key. So retireving hte backup is not possible here.

So the only option is to search for the key in the old drive - my problem is where to find the key.

I wil try to clone the drive before doing anything - can u suggest some good cloning softwares.

Thanx
Amit

This discussion is closed to new replies.