Announcement

Collapse
No announcement yet.

EFS Issue

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • EFS Issue

    I have a folder that was encrypted with EFS. I recently performed a full backup of my computer (both hidden and unhidden fies) and then reformatted the computer. Upon restoring this encryped folder I realized that I had not backed up the keys/certs. Is there anyway to recover my data? Again, I do have a full backup of my HD prior to reformatting. I also have an old CD with a backup certificate.pfx on it, but this was for the same folder which was encryped/decrypted several times before and after reformats.

    Any help would be appreciated. Thanks.

  • #2
    Re: EFS Issue

    Hi - I take it that you want to find the keys for your material on the backed up files. There is http:\\www.magicaljellybean.com\ who have a key finder. You can download it and run over the programs and files you need. If I misunderstood your request please rephrase clearer - Amos.

    Comment


    • #3
      Re: EFS Issue

      Er, no....
      AFAIK, magicjellybean recovers product keys from the encrypted versions in the computer registry. It does not recover file passwords.

      EFS relies on a certificate tied to the SID of the user account used to encrypt the files. There may also be a recovery agent account. If the PC was a domain member, you may be in luck, but if not you will probably be stuck! Another thread in this forum offers a way of recovering EFS encrypted files but I think it relies on having some of the crypto files from the original install

      Good Luck!
      Tom
      Tom Jones
      MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
      PhD, MSc, FIAP, MIITT
      IT Trainer / Consultant
      Ossian Ltd
      Scotland

      ** Remember to give credit where credit is due and leave reputation points where appropriate **

      Comment


      • #4
        Re: EFS Issue

        Just to clarify, I backed up everything I believe. I backed up System State along with hidden/unhidden files.

        Anyone know how to use the System State backup to recover the keys?

        Comment


        • #5
          Thread Can Be Closed.

          THREAD CAN BE CLOSED.
          I resolved the issue. I restore everything I had backed up - registry, files, everything. I was able to decrypt the files, save them to a USB drive, and be done with it.

          Thanks for all the input.

          Comment


          • #6
            Re: EFS Issue

            Well done!
            Tom Jones
            MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
            PhD, MSc, FIAP, MIITT
            IT Trainer / Consultant
            Ossian Ltd
            Scotland

            ** Remember to give credit where credit is due and leave reputation points where appropriate **

            Comment

            Working...
            X