Windows XP Encryption File System (EFS)

  • Thread starter Thread starter Matanel
  • Start date Start date
M

Matanel

I have encrypted files on my computer. After awhile I
was forced to reinstall Windows XP. Now I have no access
to these files. Can anyone please help me out on this
matter?
Thanks. Matanel.
 
Matanel,

For EFS to be secure, in order for an encrypted file to be opened it must
have the correct key present to first decrypt it. That way if someone else
attempted to open your documents, they would not have the key assigned to
your user account and they would not be allowed to open the file(s).

Unless 1) you backed up your certificate and private key or 2) your user
account was a member of a Windows 2000/Windows 2003 domain at the time of
encryption and is still attached to that domain or 3) you did not reinstall
Windows and still have access to an administrator account on that copy of
Windows, your data is effectively lost.

Unfortunately this happens quite often. I would suggest reading the EFS
Best Practices so hopefully it won't happen to you again. If you need to
reinstall Windows, decrypt your files first or have your key backed up.

Good luck!

http://support.microsoft.com/default.aspx?scid=kb;EN-US;223316
 
If you still have your old profile on the machine and the old password,
Microsoft PSS can help you possibily in a recovery of your old files.
 
Matt Coy said:
For EFS to be secure, in order for an encrypted file to be opened it must
have the correct key present to first decrypt it. That way if someone else
attempted to open your documents, they would not have the key assigned to
your user account and they would not be allowed to open the file(s).

Unless 1) you backed up your certificate and private key or 2) your user
account was a member of a Windows 2000/Windows 2003 domain at the time of
encryption and is still attached to that domain or 3) you did not reinstall
Windows and still have access to an administrator account on that copy of
Windows, your data is effectively lost.
Click to expand...

Actually, no. Unit the system disk (with encryption keys) has been
re-formatted,
encryption keys are still there, and encryption keys can be recovered using
special software such as "Advanced EFS Data Recovery":

http://www.elcomsoft.com/aefsdr.html

--
Sincerely yours,
Vladimir

Vladimir Katalov
Managing Director
ElcomSoft Co.Ltd.
Member of Association of Shareware Professionals (ASP)
Member of Russian Cryptology Association
mailto:[email protected]
http://www.elcomsoft.com/adc.html (Advanced Disk Catalog)
http://www.elcomsoft.com/art.html (Advanced Registry Tracer)
http://www.elcomsoft.com/prs.html (Password Recovery Software)
http://www.mailutilities.com (Email Management Software)
 
Back
Top