Recovering encrypted files

  • Thread starter Thread starter DCook
  • Start date Start date
D

DCook

I have copied encrypted file from one drive to another
and formatted the original drive, now I cannot access the
files and it gives me error "Access denied" is there any
way I can recover my files?

Thank you,
 
Possibly, but I'll warn you right now that its not easy. It depends how
much time, and potentially $, you are willing to spend on this.
Realistically, for a casual home user I'd say its as good as gone.

Basically, you should have backed up the encryption keys before
reformatting. The fact that you have the same username and password is not
enough. Obviously its easier to just decrypt the files before copying them
over.

This site details some methods to recover, but it gets quite technical:
http://www.beginningtoseethelight.org/efsrecovery/

Furthermore, Microsoft does not support many of the suggestions offered on
that page.

If the information was truly critical, the worst case scenario is that you
may need to consider taking your hard drive to a forensic recovery lab and
be prepared to spend hundreds or thousands of dollars. If this is the case,
I seriously suggest shutting down your PC as soon as possible because the
information needed may be lost for good if it gets overwritten by something
else.

Sorry to be the bringer of bad news.
 
Just to clarify: was the drive you formatted the system drive (in other
words, did you reinstall Windows?)

If so, then my other post, above, applies. :(

Otherwise, if you are still in the same installation of Windows and the
drive you formatted was just a 'secondary' drive, you shouldn't be having
any problems. Just make sure that you check the NTFS security permissions
on the file...

I just wanted to add this, just in case.
 
The same message can occur due only to NTFS
permissions, so make certain that is not the issue.
As others asked, did you destroy the bootability
of the build where these had been encrypted ?
 
First, thnak you very much for your help

Yes, I formatted original hard drive where it had encrypted the files. Is there any way I can use my current EFS and use my administrator account to de-crypt it? Is there still any possibility that I re-store my hard drive to certain day and time

Thanks,
 
You can't decrypt the files without the original key material. That key
material consists of several keys encrypting one another kind of like those
Russian Matryoshka dolls. They *may* still exist on the formatted drive,
but those keys will only be recoverable using some 3rd-party software and
there's no guarantee that they still exist. Even if you found something
that looked like the encrypted keys on the drive, it would be difficult to
say that they were the keys you need. If you could somehow determine which
keys were which and you still remembered the old user password, you could
contact Microsoft Product Support or use a 3rd-party tool to decrypt your
files.

Frankly, even though the above is all possible, unless you have lots of time
and computing power (a university, the government, large corporation) you
can probably consider your data lost.
--
Drew Cooper [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.


DCook said:
First, thnak you very much for your help.

Yes, I formatted original hard drive where it had encrypted the files. Is
Click to expand...
there any way I can use my current EFS and use my administrator account to
de-crypt it? Is there still any possibility that I re-store my hard drive
to certain day and time?
 
Back
Top