EFS files

[christian strevel]

Hello

I have some files that I encrypted with EFS on drive D:, but due to a
hardware crash I had to reformat my harddrive on drive C: and
reinstalled Windows XP.

I have the same username and password, but now I cant see the files. I
know the password and the username that was there but I'm unable to see
them... is there any way to recover those files?

I tried Advanced EFS recovery and other program but had no luck with
them... any suggestions?

Thanks in advance

 

[Steven L Umbach]

The problem for you is that the EFS certificate/private key that you used to
encrypt your files was stored in your user profile. Since you reformatted
your hard drive you destroyed your user profile and the EFS
certificate/private key and without such there is no way to access your EFS
files unless you are in an Active Directory domain that had a Recovery Agent
configured for EFS or you had previously backed up your EFS
certificate/private key to a password protected .pfx file in external media
to use in situations like you are in now to access your files. I wish I had
better news but there are no backdoors to EFS without the existence of any
EFS certificate/privates keys that are able to decrypt the files. --- Steve


http://support.microsoft.com/default.aspx?scid=kb;en-us;223316&sd=tech ---
EFS best practices.

 

[christian strevel]

Thanks for answering me. So there is no possible way to recover those
files by any way? Absolutely no WAY? omg ...

Are you really-really sure?

 

[Mike Fields]

IF you have some sort of image backup from the past of
the C drive so you could restore and get the keys again,
you could recover them. You can also crack the files ... the
bad news is you probably don't have the time or computing
horsepower to do that (the files are encrypted with the DES
process which is not trivial to crack). Hope you had a
backup image of the drive ... sorry ' bout that ;-(

mikey

 

[Steven L Umbach]

Technically it may be possible for a data recovery expert to examine your
hard drive to see if the needed files are recoverable to reconstruct your
EFS certificate/private key if they were not overridden during the
format/reinstall. My guess that could probably cost at least a few thousand
dollars with NO guarantee of results. Otherwise brute force cracking could
be attempted if you could perhaps lease all of NSA computers for at least a
decade or so. --- Steve