Reocvering Files Encrypted by EFS

[Jake]

My Win2000 machine recently had a registry failure which
porevents the os from loading. I set up a new installation
of Win2000 on a new master drive. I want to recover files
that were encrypted by efs from the old installation and
move them to the new one. I've searched through the KB to
no avail. I still know the old admin account password but I
don't have a backup copy of the recovery agent certificate.
I would appreciate anyone who can direct me to a useful
artcile or has any tips themselves.

 

[Missy]

you need the old the recovery agent certificate. from the old OS.
or if you backed up the the recovery agent certificate. use that.

 

[Jake]

I can't start the old Os (beacause of the registry failure
- the cause of all these problems) to export the recovery
agent certificate by the normal means, is there a way to do
it remotely?

 

[Karl Levinson [x y] mvp]

I agree. Hopefully you didn't wipe out the documents and settings folder
for the user that encrypted the files. If you did, your job just got harder
if not impossible. www.beginningtoseethelight.org has information on EFS
file recovery. There are some articles also in the FAQ at
http://secuityadmin.info/faq.asp#efs

 

[Peet]

I have a similar Problem and try to approach it like this:

There is a software called Advanced EFS Data Recovery that
only needs the Keys and not the certificates to work.

http://www.elcomsoft.com/aefsdr.html

In order to get the keys, let AEFSDR search for them on
your HD that has the old system.
If you already formated that drive, use a software
called "Virtual Data Recovery".

http://www.binarybiz.com/vlab/windows.php

If you are very lucky, the keys may still be recoverable.

Use AEFSDR to find the location of your current keys
(search for the number of the keys in windows and remember
the directory) and then recover the keys with VDR in the
respective directories of the recovered partition.

You have 1 MB free, so it should be enough to get the keys.

If it works, you can now decrypt the keys with AEFSDR and
after that your files.

For myself this did not work, for the private key was
recoverable, but is somehow corrupted.
Now I only have my old system keys that I cannot decrypt
although I know my old password.

If anybody can help me out, I would appreciate it.