data recovery

[Air]

I have a laptop whose motherboard died and the the data I need to retrieve
was encrypted. I tried to get to it by pulling the hard drive off and
navigating to that folder but the user made them private!
Is there anyway to recover the data?

 

[Leonard Grey]

Without the password? Not a chance.

 

[nass]

Hi Leo,
Without the password, the chances are in a thin AIR LOL

 

[Air]

LOL
I figured as much I have the password for the OS but since there's no
motherboard I can only get to data via putting HD on another PC. Is there a
way to use the pw thru windows explorer?

A

 

[John John - MVP]

You need one of two things to recover your encrypted files:

1- You need a backup copy of the EFS certificate to open the files from
a different Windows installation. Knowing the password alone is not
sufficient unless your are logged on to the Windows installation where
the files were created.

2- You need to logon to the original Windows installation, see above.

John

 

[Leonard Grey]

If you know the password it only remains to take ownership of the folder.

Search the web using this search term:

take ownership of a folder in windows xp

 

[Air]

Since I sent this email I had a brilliant thought to try it on my Vista
machine and while I could view the files I’m in the process of PAINFULLY
changing permissions and ownership rights. Not all files is it working for
but I’ve got some iTunes back so far.

 

[Bob Harris]

If the files are encrypted by XP, you probably have little hope, unless you
deal with a professional ($$$) file recovery firm.

The fact that you were able to get some files via Vista leads me to believe
that they were not actually encrypted. Rather, this appears to be a case of
file "ownership", which is a different thing altogether.

You might want to try using a LINUX "live" CD to boot the PC. Being a
non-Microsoft operating system, it ignores the XP permissions. Modern LINUX
can read NTFS, as well as FAT32, the two partition formats that XP uses. I
suggest KNOPPIX, since it tends to automatically detect most hardware,
including SATA drives, video cards, etc. Download an ISO image from the
following link. I suggest the CD version 5.1. Do not try 6.0, as that is
still experimental, and has limited hardware support. And, you do not need
the DVD version for simple file recovery.

http://www.knopper.net/knoppix/index-en.html

Burn the ISO to CD, then boot the PC to which the old hard drive is attached
(e.g., via USB, or internal wire). You should come to a KNOPPIX desktop,
with all internal hard drives indicated as icons with names like "hda1".
Use one of the file managers to view the hard drives. You should rapidly
find the old one. Then, work down through directories until you find your
files. You should be able to do a copy and paste form the old drive to
either the internal drive or to an external drive.