....continuation of my previous post "HOW TO UN-ENCRYPT
FILES??"....

If the user had the Private Key included in his 2-week
old backup set and we wanted to ONLY restore that (rather
than all the data) -- what file or files would be look
for?

~Thanks!

Jennifer Moulton wrote:

> ...continuation of my previous post "HOW TO UN-ENCRYPT
> FILES??"....
>
> If the user had the Private Key included in his 2-week
> old backup set and we wanted to ONLY restore that (rather
> than all the data) -- what file or files would be look
> for?

Hi

Here is an extract about this from
http://www.beginningtoseethelight.org/efsrecovery/

<quote>
if you have following folders and their contents from the orginal install of 2k
or xp - you can recover you efs data. knowledge of your password is also
required for this amount of data.

c:\documents and settings\foo\application data\microsoft\crypto\
- private keys

c:\documents and settings\foo\application data\microsoft\protect\
- locks your current password to your private keys

c:\documents and settings\foo\application data\microsoft\systemcertificates\
- public keys (not essential to be the orginal as another valid key can be
madeup)

this data maybe on an unbootable system, a backup, roaming profile or currently
on the system, either in the file system or in the free space.
</quote>

Please read the rest of the Web page at
http://www.beginningtoseethelight.org/efsrecovery/

--
torgeir
Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of the 1328 page
Scripting Guide: http://www.microsoft.com/technet/scriptcenter