Hardware

Ask something
Discussion Locked

Please Help! Decrypt (EFS) Encrypted Files On Windows

0 helpful
11 replies

by codeblue94

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

So basically the situation is I backed up all of my files on an external hard drive with no software use. Just simple drag and drop to keep a copy.

After I was done backing up the stuff, I took the internal hard drive and plugged it into my new PC and did a format of that hard drive and installed Windows 7. So now I plug in my external hard drive so that I can transfer in my backed up files but then I noticed that everything is highlighted green......everything is encrypted and it will not allow me to transfer any of my files to my computer and the bastard won't even let me open up the files, it just keeps saying access denied and saying I don't have permission to do so. Am I really screwed over? Because I cannot afford to lose all of this files. And it's so annoying too because the files are taking up the space so I know that the file is there for me ready to be used but it just blocks me with the encryption! Is there anyway to remove the encryption or just get it to work? I really need those files :(

11 replies

by seanferd

I took the internal hard drive and plugged it into my new PC and did a format of that hard drive

Oops. No way to every recover the original account and its encryption key, now.

Because I cannot afford to lose all of this files.

You may have some luck forking over a lot of cash to Microsoft, or a data recovery house.

by codeblue94

the format I have done was a quick one. So I know that I might have a chance to use some software to recover files but I still feel sketchy about it

by ansugisalas

Best go to the best solution first though, and be sure to use one that [b][i]writes to a different drive than is being recovered[/i][/b]
Ask a cyberforensics company, if anyone can, they're it.

by seanferd

Go ahead, give it a shot. If you want any hope of recovering anything, you certainly shouldn't be using the drive at all. But I think you pretty much need the intact installed OS and user account to access the encrypted files.

http://www.petri.co.il/how_does_efs_work.htm

Now, assuming you are able to at least pull up the key storage in
%User Profile%\Application Data\Microsoft\Crypto\RSA\User SID
%User Profile%\Application Data\Microsoft\Protect\User SID
or maybe even the whole user profile, you'll have to hack this back in to an installation of whatever flavour of Windows it came from, and hope it works.

by codeblue94

the format I have done was a quick one. So I know that I might have a chance to use some software to recover files but I still feel sketchy about it

by codeblue94

the format I have done was a quick one. So I know that I might have a chance to use some software to recover files but I still feel sketchy about it

by codeblue94

the format I have done was a quick one. So I know that I might have a chance to use some software to recover files but I still feel sketchy about it

by codeblue94

the format I have done was a quick one. So I know that I might have a chance to use some software to recover files but I still feel sketchy about it

by codeblue94

the format I have done was a quick one. So I know that I might have a chance to use some software to recover files but I still feel sketchy about it

by hal 9000

Pretty well as M$ has a very straight Forward Warning when you first set Encryption. You are effectively Screwed Blue and Tattooed.

They tell you [b]No Encryption Key No Data[/b] it's really as simple as that.

Here your only chance if you need the Files is to pay a Data Recovery House which has the ability to Break M$ Encryption and this effectively means a Data Recovery House who has Access to M$ Coffee so to have that they need to be a Security Specialist or Law Enforcement.

While you may have a small chance of rebuilding the Formatted HDD that in itself is going to require a massive effort and lots of Money and even then there is no guarantee that it's going to actually work. The Professional Software capable of doing this comes in in excess of 1K and the only one that I know of that works quite well is the On Track's Offering and even then I have no idea if using that software will be suitable to make the Encryption Key usable again. I've never attempted it so I have no idea but the Software Description can be found here

http://www.krollontrack.com/resource-library/free-downloads/

Personally unless you have access to this software I wouldn't suggest buying it I would suggest that you put the money it costs toward the Recovery Operation. I know On Track is capable of performing a Recovery like this but I have no idea of who else is you'll have to ask each Data Recovery House if you simply [b]Must[/b] recover the Data here. ;)

Col

by ansugisalas

Best bet might be to incriminate oneself, like drop an anonymous hint about terrorist connections or something.

This discussion is closed to new replies.