Files Encrypted by windows cannot be accessed after Format.

[Guest]

I had several files encrypted, using windows encryption from the Advanced
Attributes in the Properties tab. That was on a secondary hard drive.
At some point I Formated my main drive which i had windows on.
Now the formerly encrypted files cannot be accesed no matter what i do.
I cannot delete, copy, cut or anything else through normal windows actions.
I can get the message that i do not have the propper rights to access them.
This is on my PC, logged in as the Admin.
It seems like the only person with access to the files is the pre-format
administrator.
PLEASE is there any way i can get my files back?
If any other info is necesary i would be more than glad to provide it.

Many thanx in advance

 

[Demmpa]

The Relinquished skrev:

I had several files encrypted, using windows encryption from the Advanced
Attributes in the Properties tab. That was on a secondary hard drive.
At some point I Formated my main drive which i had windows on.
Now the formerly encrypted files cannot be accesed no matter what i do.
I cannot delete, copy, cut or anything else through normal windows actions.
I can get the message that i do not have the propper rights to access them.
This is on my PC, logged in as the Admin.
It seems like the only person with access to the files is the pre-format
administrator.
PLEASE is there any way i can get my files back?
If any other info is necesary i would be more than glad to provide it.

Many thanx in advance

You need take ownership of a files
http://support.microsoft.com/kb/308421

 

[Guest]

You need take ownership of a files
http://support.microsoft.com/kb/308421

I allready had ownership of the files. And i can change it at will to either
Administrator or my regular account. Still nothing.

Something i noticed: on the security tab of the folder containing the files
I get 4 Groups of Usernames. 3 of them reffer to either me or everyone in
general, and one of them is called "CREATOR OWNER". That group had no
Permissions at all on the folder(everything is un-ticked). I ticked every
option on Permissions, clicked "Apply" and the Permissions get unticked.

I belive that the main problem is that the files are encrypted. In
Properties->General->Advanced the Encrypt contents option is ticked. I cannot
untick it.
Thus no program can open the files(video files).

 

[Malke]

I allready had ownership of the files. And i can change it at will to either
Administrator or my regular account. Still nothing.

Something i noticed: on the security tab of the folder containing the files
I get 4 Groups of Usernames. 3 of them reffer to either me or everyone in
general, and one of them is called "CREATOR OWNER". That group had no
Permissions at all on the folder(everything is un-ticked). I ticked every
option on Permissions, clicked "Apply" and the Permissions get unticked.

I belive that the main problem is that the files are encrypted. In
Properties->General->Advanced the Encrypt contents option is ticked. I cannot
untick it.
Thus no program can open the files(video files).

If you really used encryption (EFS) and neglected to back up your
encryption keys then the data is lost. You can check out the information
at Elcomsoft (link below). If they can't help you, consider the files
gone and delete them.

http://www.elcomsoft.com/aefsdr.html


Malke

 

[Brian Komar]

I had several files encrypted, using windows encryption from the Advanced
Attributes in the Properties tab. That was on a secondary hard drive.
At some point I Formated my main drive which i had windows on.
Now the formerly encrypted files cannot be accesed no matter what i do.
I cannot delete, copy, cut or anything else through normal windows actions.
I can get the message that i do not have the propper rights to access them.
This is on my PC, logged in as the Admin.
It seems like the only person with access to the files is the pre-format
administrator.
PLEASE is there any way i can get my files back?
If any other info is necesary i would be more than glad to provide it.

Many thanx in advance

1) Did you back up your EFS encryption keys from the certmgr.msc console
*before* you formatted the OS drive.
If the answer is no, then you have lost the easy way to recover the files

2) Did you back up the local Administrators EFS recovery keys? If the
answer is no, then you lost the 2nd easiest way to recover the keys

3) Does your computer belong to a domain? If yes, the account that holds
the EFS recovery agent *may* have the EFS recovery key for the domain, abd
be able to recover your file. If you look on the General tab, then click
Advanced, within there you should be able to view the thumbprint of the
recovery certificate. They would need to have the certificate *and private
key* to perform the recovery.

4) Did you keep a backup of the old "Documents and Settings" folder that
you can restore. This would place the required binaries of the encryption
keys back on the hard disk (You formatted the drive, right). If you did
have these backups, then you could purchase an EFS recovery program that
would allow you to re-use these keys, as longs you know the last password
that you used on the system *before* the format (this is required to
decrypt the keys that are protected by the DPAPI).

If you answered no to all of these, the files are lost.

Brian

 

[Guest]

1)No
2)No
3)No
4)Guess what. No.

Ok then. Thanx for the help everyone. Thumbs up.
I guess the joke's on me. I can't even delete them.

Now, I wonder if there are any hacking tools out there that could break that
encryption...
But I am in the wrong newsgroup for that i guess. Anyhow, thanx again.

 

[Malke]

1)No
2)No
3)No
4)Guess what. No.

Ok then. Thanx for the help everyone. Thumbs up.
I guess the joke's on me. I can't even delete them.

Now, I wonder if there are any hacking tools out there that could break that
encryption...
But I am in the wrong newsgroup for that i guess. Anyhow, thanx again.

No, you're wrong - if there were hacking tools for EFS encryption I'd
tell you. It wouldn't be very good encryption if there were. Contact
Elcomsoft - premier hackers - and see what they say.


Malke