EFS file unable to decrypt

[MJ w/ 2 TJs]

i had multiple files encrypted on my local system. I have changed passwords
a dozen times since encrypting and of course, now i cannot decrypt them. i
was unaware of the microsoft "feature" that required you to decrypt, change
password, then re-encrypt. this is on a stand alone XP station service pack
2. any help would be appreciated.

 

[Steven L Umbach]

You should not have a problem if you change your password via
control-alt-delete. The problem comes if you "reset" the password via Local
Users and Computers. You will have to keep trying passwords to find the one
that can unlock your EFS private key to allow decrypting the files.
Otherwise you are out of luck. --- Steve

 

[MJ w/ 2 TJs]

Thanks Steve,
Unfortunately, i did it through LUG. I have found several utilities that
"may" be able to do it, however, i don't feel like dropping $$ on it, but I
do need the files...a brute force is looking like my only alternative.

m

 

[Steven L Umbach]

The utility I tried requires that you know the password used to protect the
EFS private key and is usually used in cases where a user reinstalled the
operating system but has the original user profile. Elcomsoft does have a
free trial version though it will only decrypt small files if you know the
corresponding password. By brute force I assume you mean password guessing.
You will never be able to brute force the encryption itself in XP Pro
without the help of the CIA/NSA and have a long wait. Sorry to hear the
files were important. You might try to scan the drive for old or temporary
copies of clear text files that you might be able to recover. It would be a
long shot but better than trying to crack EFS encryption. I have found that
File Scavenger can find a lot of stuff in a deep scan and they have a free
trial version. -- Steve