EFS Encryption

[andrew]

HI.


I upgraded a clients machine for him with a new motherboard and cpu. I
then installed windows xp onto his system again (it already had a copy
of windows installed) to a new folder - windows.0.

The old motherboard and cpu was then thrown away.

Today, we discovered that all of the clients documents were still in
his old user account which to our shock was encrypted with EFS, or more
likely simple file sharing (is this the same?)

What can I do about this problem?!?! The client is coming in tomorrow
morning to fetch his pc and I am screwed. When I try to access his old
user account from the new windows it says access denied. I have managed
to use ERD commander to copy the encrypted files from the encrypted my
documents folder to the new, unencrypted one but they are still
unviewable.

The old windows and the old user account is still available. Can it be
fixed?

PLEASE HELP

 

[Carey Frisch [MVP]]

If you failed to make copies of your certificate (and no recovery agent certificates exist),
you won't be able to recover your encrypted files. No back door exists, nor is there any practical
way to hack these files. (If there were, it wouldn't be very good encryption.)

HOW TO: Remove File Encryption in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;308993

Without a backup of the original Encryption Certificate Key, encrypted files
are unrecoverable as they will stay encrypted forever. There is no recovery
method since the encryption algorithm is now completely different with a
reinstall of Windows XP.

See if the following articles help in any way:

HOW TO: Take Ownership of a File or Folder in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308421

Best Practices for the Encrypting File System
http://support.microsoft.com/default.aspx?scid=kb;en-us;223316

Encrypting File System in Windows XP
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/cryptfs.mspx

EFS Files Appear Corrupted When You Open Them
http://support.microsoft.com/default.aspx?scid=kb;en-us;329741


--
Carey Frisch
Microsoft MVP
Windows - Shell/User

Enjoy all the benefits of genuine Microsoft software:
http://www.microsoft.com/genuine/default.mspx

---------------------------------------------------------------------------­---------------------------------

:

| HI.
|
|
| I upgraded a clients machine for him with a new motherboard and cpu. I
| then installed windows xp onto his system again (it already had a copy
| of windows installed) to a new folder - windows.0.
|
| The old motherboard and cpu was then thrown away.
|
| Today, we discovered that all of the clients documents were still in
| his old user account which to our shock was encrypted with EFS, or more
| likely simple file sharing (is this the same?)
|
| What can I do about this problem?!?! The client is coming in tomorrow
| morning to fetch his pc and I am screwed. When I try to access his old
| user account from the new windows it says access denied. I have managed
| to use ERD commander to copy the encrypted files from the encrypted my
| documents folder to the new, unencrypted one but they are still
| unviewable.
|
| The old windows and the old user account is still available. Can it be
| fixed?
|
| PLEASE HELP

 

[Markoni]

Hello:

I’m having a problem with EFS. I inadvertently encrypted a directory
under Windows 2000. I backed up the ’Documents and Settings’ folders
(but did not export any keys) before reformatting the hard drive, and
was left with quite a number of encryption keys in various locations.
I’ve now switched to XP, and am unable to decrypt the encrypted files
(which are still on another drive - I’ve not been able to move them).
Advanced EFS Recovery doesn’t do the trick, and I’ve tried moving the
old key files to the XP locations where I presume they should be, but
again without success. Is there any way around this problem?

Many thanks for any advice.

 

[Steven L Umbach]

Unfortunately if Advanced EFS Recovery did not help then you almost
certainly are out of luck. You could also try emailing them to see if they
can help any further giving as many specifics as you can.

Steve