EFS -- alternatives to KB307545?

[none]

Hi,

I have computer that reboots repeatedly, giving a message with "Lsass.exe"
in the title bar and "When trying to update a password this indicates that
the value provided as the current password is not correct." So far I have
found a possible solution in KB307545. However, this solution appears to
wipe out all programs installed after Windows setup (not preferable). Also,
I have EFS-encrypted files that I would like to recover and my
interpretation is that using KB307545 would not allow that (also I didn't
make a key for them). Does anyone know of any better solutions other than
Automated System Recovery (ASR) (not an alternative since I didn't make
recovery disks)? Am I incorrect about KB307545 rendering my EFS-encrypted
files unreadable?

Thank you

 

[none]

Forgot to mention that the OS is XP SP2

 

[Vladimir Katalov]

Hi,

I have computer that reboots repeatedly, giving a message with "Lsass.exe"
in the title bar and "When trying to update a password this indicates that
the value provided as the current password is not correct." So far I have
found a possible solution in KB307545. However, this solution appears to
wipe out all programs installed after Windows setup (not preferable).
Also, I have EFS-encrypted files that I would like to recover and my
interpretation is that using KB307545 would not allow that (also I didn't
make a key for them). Does anyone know of any better solutions other than
Automated System Recovery (ASR) (not an alternative since I didn't make
recovery disks)? Am I incorrect about KB307545 rendering my EFS-encrypted
files unreadable?

It depends on how old the Registry files in "repair" folder are, but in most
cases, you will loose access to your EFS-encrypted files by replacing
registry files,
because the passwords will be reset:

http://support.microsoft.com/?kbid=290260

In any case, you should perform a complete backup of your hard disk, or
at least the system partition, and partition where the encrypted files are
stored.

Then I can recommend you to get HDD out of your computer, attach it to
another Windows 2000/XP system where you have Administrator
privileges, and use our AEFSDR software to recover/decrypt all encrypted
files (I hope that it is still possible):

http://www.elcomsoft.com/aefsdr.html

Now you can follow the suggestions mentioned in KB307545. Just note
that you may still loose the credentials and some other information.

--
Sincerely yours,
Vladimir

Vladimir Katalov
CEO
ElcomSoft Co.Ltd.
mailto:[email protected]
http://www.elcomsoft.com

 

[none]

Vladimir,

Why would it be necessary to use the problematic HDD to attempt file
recovery?

 

[Vladimir Katalov]

Vladimir,

Why would it be necessary to use the problematic HDD to attempt file
recovery?

You said that you cannot boot properly, so you will have to detach
the disk and use it some other computer (or boot Windows PE from
CD). Also, you need Administrator privileges to use AEFSDR.

--
Sincerely yours,
Vladimir

Vladimir Katalov
CEO
ElcomSoft Co.Ltd.
mailto:[email protected]
http://www.elcomsoft.com

 

[none]

But can I not use the backup of the disk? This would be much more
convenient.