EFS Recovery

G

Guest

I see a lot of information about this subject, but nothing that addresses my
problem. I'm a computer tech with a rather large company of over 10,000
worldwide. Due to sensitive data issues, we encrypt the My Documents folder
and the Outlook folder on every computer in the company. I deal mainly with
laptops. When a laptop hard drive is dying, I need to get the data from it.
It is not bootable when I get it, so I connect it to a USB device I connect
toa box I built for data recovery. The laptop hard drive is now a slave
drive to the desktop computer. In some cases, not many, but enough to
warrant this question, I can see the file structure except for the encrypted
folders.

In order to run the EFS Recovery process in house, I need to be able to see
the data so I can unencrypt it after running the Backup and Restore on the
slave drive. But I can't even run the NTBackup on those folders because they
appear invisible. Even a hard drive search gives me nothing. Show all
hidden files is checked so I can see everything.

Some think MS encrypted data really isn't where you see it, but is mirrored
somewhere else for its own protection. I'm sure it is still on the hard
drive. I just can't see or find it.

I need to know how to locate that encrypted data so as to be able to run the
NTBackup and Restore features of EFS Recovery to unencrypt it. I would think
it would be a rather simple solution and I may be overlooking something here,
but I'm just not seeing it.

Please, if anyone knows where this data is hiding and how to expose it so I
can recover it, I would appreciate it. Tried calling MS on this and kept
getting pushed up the ladder until they wanted to send this to the
Professional level and charge me $245.00. Because this is business related,
I couldn't authorize that expense. So, I'm trying this forum in hopes
someone can help me out.

Thank you for any information that may help. If you want to contact me
directly, please send email to (e-mail address removed)

Thanx, Rick
 
G

Guest

Rick, if you have resolved this would you please respond with what you found
out?

If you haven't found a resolution, can you provide a few more clues:
1. What OS were the laptops running and what OS is on your recovery station?
2. Is the File Recovery certificate that applied to the encrypted files
installed on your recovery station?
3. Is the recovery station OS on NTFS or FAT32?

If EFS was used to encrypt the files, the files should still be physically
located where they were encrypted--in the My Documents folder. I'm guessing
that what you have heard about encrypted files residing in a virtual location
may be in reference to offline encrypted files. Were the files on these
laptops enabled for offline encryption?

Thanks.
Pat
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads


Top