Ecrypted files inaccessible after password reset

  • Thread starter Thread starter Oliver
  • Start date Start date
O

Oliver

Hi,

I recently forgot the password to my user account on my local machine, so I
looged in as administrator and did a password reset for my user account. When
I went back into the user account, I could no longer access any of the
encrypted files. Why is this and how can I make them accessible again?
 
Oliver said:
Hi,

I recently forgot the password to my user account on my local machine, so I
looged in as administrator and did a password reset for my user account. When
I went back into the user account, I could no longer access any of the
encrypted files. Why is this and how can I make them accessible again?
Click to expand...

Remember the original password and change back. See the last section of
http://support.microsoft.com/kb/331333/

Another victim realizes too late the dangers of the Windows Encrypting
File System. For those lurkers who feel an irresistible urge to use
Windows EFS, make sure to follow the "Best Practices" -
http://support.microsoft.com/kb/223316/en-us

There is also KB316994. This Hotfix probably does NOT apply to you
because you [probably] don't satisfy criterion 4 ("You have logged on to
your computer by using cached credentials when your computer is not on
the network"). I'm virtually certain that the Hotfix will not work
without cached credentials -- if it did, that would be a much too easy
back door past the EFS.
 
Remember the original password and change back.
Click to expand...

Alternatively, do a System Restore to a date before you changed the
password then keep trying passwords.

-- John
 
You basically have two options: remember the password, or try accessing the
files as Administrator. (which account is usually set as the recovery agent
 
John said:
Alternatively, do a System Restore to a date before you changed the
password then keep trying passwords.

-- John
Click to expand...

Once the System Restore is done, and the original password is
back in place, there might be some tool around that can figure
out the password. For example, here a LiveCD is mentioned, that
can automatically crack the passwords. I have no idea how safe this
is, whether source code is available etc etc. But if you're desperate,
and willing to do whatever it takes to get the data back, something
like this might work.

http://www.raymond.cc/blog/archives/2006/11/22/how-to-crack-windows-account-password/

http://en.wikipedia.org/wiki/Ophcrack

Paul
 
Anteaus said:
You basically have two options: remember the password, or try accessing the
files as Administrator. (which account is usually set as the recovery agent
Click to expand...

No, logging in as an administrator will not work. The only way to access
those files without the encryption key is with the password.

There are tools out there that may be able to crack the password, but there
is no guarantee that they will work for you.
 
In
sanjacstudent12 said:
No, logging in as an administrator will not work. The only
way to access those files without the encryption key is
with the password.

There are tools out there that may be able to crack the
password, but there is no guarantee that they will work for
you.
Click to expand...

To date, and this is something I watch for all the time, there
has never been anything that could crack the passwords if the
password was anything barely useful as a password. e.g., not
their last name, etc..
 
To date, and this is something I watch for all the time, there
has never been anything that could crack the passwords if the
password was anything barely useful as a password. e.g., not
their last name, etc..
Click to expand...

Depending on the configuration of Windows, "skRV96vhP!z" is cracked very
fast
 
Back
Top