Encrypted files

[M and D]

I think I see what Kerry is getting at. With the proper equipment and training, and plenty of money, it might - might - be possible to retrieve an encryption key from a formatted disk. But from what I understand of such things, the odds of success are low.

Steven

 

[Jupiter Jones [MVP]]

I understand now.
That may be possible.
It would probably be expensive and I have never heard of success.
But if the data is that valuable.
Proper use of EFS is still the preferred option to save from this kind of
trouble.

--
Jupiter Jones [MVP]
http://www3.telus.net/dandemar
http://www.dts-l.org


I think I see what Kerry is getting at. With the proper equipment and
training, and plenty of money, it might - might - be possible to retrieve an
encryption key from a formatted disk. But from what I understand of such
things, the odds of success are low.

Steven

 

[Kerry Brown]

I think I see what Kerry is getting at. With the proper equipment and
training, and plenty of money, it might - might - be possible to
retrieve an encryption key from a formatted disk. But from what I
understand of such things, the odds of success are low.

If you are willing to spend the money the odds are pretty good something can
be recovered. The last time I used such a service was many years ago with a
MFM 10 MB hard drive that had been low level formatted, partitioned, high
level formatted, then DOS, Windows, and applications reinstalled. They were
able to recover about 80% of the old data. I'm assuming that the data
recovery process has gotten better in the last twenty years.

Kerry

 

[Kerry Brown]

I understand now.
That may be possible.
It would probably be expensive and I have never heard of success.
But if the data is that valuable.
Proper use of EFS is still the preferred option to save from this
kind of trouble.

It would make life easier if EFS was harder to get at or there was a warning
that popped up before you started using it

It does amaze me that so many people use EFS and then figure there must be a
back door once it goes wrong. Why would they have used it in the first place
if they thought it could be broken?

Kerry

 

[Jupiter Jones [MVP]]

I see it a few times a month unfortunately.

 

[Vanguard]

I don't believe you cause there must be another way to decrypt those
files...cause u can't loose important files just like that??? Common...WTC
crashed and they still found lost files on pc's...there must be another
solution...I had 20GB encrypted files and I can't even delete them...does
that mean that I can throw away my harddisc cause there is no more space?

Decryption. Deletion. They are two separate actions. Nothing stops you
from deleting the files. You are only stopped from reading them. If you
cannot delete them, you don't have permissions to them, which means you are
logged in under the wrong account.

 

[Gil Baron]

uaranteed. Once you have recovered the keys
it is easy to decrypt the files.

If having the key is all you need and that implies the key is not encrypted abdrequires a pass phrase then EFS is not secure and is worse than useless and Iwould rely on such as PGP.

 

[Kerry Brown]

If having the key is all you need and that implies the key is not
encrypted abd requires a pass phrase then EFS is not secure and is
worse than useless and I would rely on such as PGP.

It is possible to remove the certificates from the system and password
protect them. As the OP had no idea there even was keys/certificates
involved it is pretty unlikely they did this. PGP also uses keys which have
to be protected. Any key based system has this weakness.

Kerry

 

[Jupiter Jones [MVP]]

This is not really a weakness.
Not having the keys is evidence you are not authorized access.
Just like it is not a weakness of your automobile for it not to start if the
key is lost.

 

[Shenan Stanley]

I encrypted some files before formatting windows and reinstalling
and now I can't open those files...what to do?

As all the other responses have told you - you've lost the files.

You used a technology without fully understanding it and ended up losing
something because of it. It can and does happen every day. It doesn't have
to - but it does. It happened to you now - and I feel for you on some
level. It's a tough lesson to learn - but is not likely the first or last
tough lesson you will face in your life. Learn from it and next time - *if*
you use EFS again - use it wisely and correctly.

Best practices for the Encrypting File System
http://support.microsoft.com/kb/223316/

How to back up the recovery agent Encrypting File System (EFS) private key
in Windows Server 2003, in Windows 2000, and in Windows XP
http://support.microsoft.com/kb/241201

Using Efsinfo.exe to determine information about encrypted files
http://support.microsoft.com/kb/243026/

 

[Kerry Brown]

This is not really a weakness.
Not having the keys is evidence you are not authorized access.
Just like it is not a weakness of your automobile for it not to start
if the key is lost.


It is possible to remove the certificates from the system and
password

You're right it's not really a weakness just the way it works. It is a point
of failure that you have to be aware of. Most people using encryption of any
kind don't seem to be aware of the implications of losing the keys.

Kerry

 

[Richard Urban]

If it's a failure, it is a failure on the user's part in not understanding
how encryption works. It is NOT a failure of the encryption mechanism, nor
is it a failure of the concept. The concept is rock solid!

--


Regards,

Richard Urban
Microsoft MVP Windows Shell/User

Quote from George Ankner:
If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!

 

[Kerry Brown]

If it's a failure, it is a failure on the user's part in not
understanding how encryption works. It is NOT a failure of the
encryption mechanism, nor is it a failure of the concept. The concept
is rock solid!

It's a failure point for the procedure of encryption. Why it fails (user
problem) is irrelevant. It is a possible point of failure and needs to be
planned for. Most people don't do the planning so when the key is lost the
procedure fails

Kerry

 

[Richard Urban]

There you go. USER error! Not encryption error.

--


Regards,

Richard Urban
Microsoft MVP Windows Shell/User

Quote from George Ankner:
If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!

 

[Gil Baron]

this. PGP also uses keys which have
to be protected. Any key based system has this weakness.

Yes but pgp forces you to create a pass phrase and even helps to create a strong one, It never stores the key in th clear. Strong pass phrase makes pgp and similar systes basically unbreakable if you choose a large key.

 

[Kerry Brown]

Yes but pgp forces you to create a pass phrase and even helps to
create a strong one, It never stores the key in th clear. Strong pass
phrase makes pgp and similar systes basically unbreakable if you
choose a large key.

EFS is also unbreakable unless you have the key. The key is password
protected with your Windows user password. Even if you have physical access
you still need to know the password, same as PGP.

Kerry

 

[Kerry Brown]

There you go. USER error! Not encryption error.

Wasn't aware that I ever said it was an error that anything to do with
encryption. The whole thread has been about lost keys which is obviously a
user error.

Kerry

 

[Gil Baron]

EFS is also unbreakable unless you have the key. The key is password
protected with your Windows user password. Even if you have physical access
you still need to know the password, same as PGP.

And tell me how many users create a strong password and none of which can be aslong as the pgp phrase
I realize pg integration sucks though so EFS would be used more but removing the key woukd be a lot safer if physical securityc cannot be assured.

 

[Guest]

I have the same problem. Didn't know about backing up the EFS certificate.
However, I DID backup the entire contents of the hard disk, so presumably the
original EFS certificate should be there - is there a was I can find it among
the files I restored under "Old C Drive" folder and recover it from there?

I have the computer set up with the identical user name and password I was
using before; would I be correct in assuming the encryption algorythm would
make use of that information?

 

[Vanguard]

I have the same problem. Didn't know about backing up the EFS certificate.
However, I DID backup the entire contents of the hard disk, so presumably
the
original EFS certificate should be there - is there a was I can find it
among
the files I restored under "Old C Drive" folder and recover it from there?

I have the computer set up with the identical user name and password I was
using before; would I be correct in assuming the encryption algorythm
would
make use of that information?

I see the path "%userprofile%\Application
Data\Microsoft\SystemCertificates\My" looks to have something regarding the
certs. There is also the "%userprofile%\Application Data\Microsoft\Crypto"
that contains encrypted information. However, there is probably matching
data in the ntuser.dat file (the user's keys for the registry) that need to
be used in concert.

I'm not an EFS crypto expert but just another user of EFS, so not having the
exported cert means that I cannot decrypt EFS-protected files accessed under
a different instance of Windows. There are lots of articles at Microsoft,
like
http://technet2.microsoft.com/WindowsServer/en/Library/3f5fdc52-8623-4336-840d-e90b2399c8541033.mspx,
but I don't have the time to make it another career. According to
http://www.accessdata.com/ftkuser/index.html, "EFS Certificate Lists ($EFS
streams) *- FTK will now recognize and interpret $EFS streams. EFS encrypted
files contain an NTFS data stream named "$EFS" which contains a list of
certificates for each user who is able to access the file." I used
Rekenwonder's Stream Explorer and could see the same 164-byte ADS was
attached to to a sample of my EFS-protected files (I wan't going to check
them all). As to whether or not this FTK forensic program can decrypt
EFS-protected files, I don't know. You could ask them. The FTK program
costs $1100. They have forums at http://forums.accessdata.com/ where you
could ask.

If you have the original drive that was not formatted and so all of the
%userprofile% still exists, I believe that there are pay services where you
can get them to decrypt your EFS-protected data files. Such services are
probably very expensive.