Comments on: Encrypted files on External HD, host machine formatted but recoverable

By: trelleborg

trelleborg — Wed, 11 Jan 2006 16:42:52 +0000

I have recovered the certificate with the correct Thumbprint, what else do I need? What other files do I need where are they located ect…? I anyone can give me details instructions on this of maybe a link to instructions I would be greatful…

By: boardinhank

boardinhank — Fri, 09 Dec 2005 16:56:43 +0000

Strait from microsoft to you this is according to their EFS.

How files are encrypted
Files are encrypted through the use of algorithms that essentially rearrange, scramble, and encode the data. A key pair is randomly generated when you encrypt your first file. This key pair is made up of a private and a public key. The key pair is used to encode and decode the encrypted files.

If the key pair is lost or damaged and you have not designated a recovery agent, and then there is no way to recover the data.

Might have to chalk it up to a learning experience. Before working with EFS or any other encryption it is best to document, designate and then implement.

By: lirria

lirria — Thu, 08 Dec 2005 10:56:04 +0000

It’s been awhile – but if I recall correctly the encryption key is based on the password of the account creating it – unfortunately, once you change the password that key is lost (unless you are logged in as them) I think Elcomsoft Advanced EFS Data Recovery might be able to help – not sure – I have had no experience with it, but it seems to indicate that it can recover (decrypt) files.

Good luck!!

Lirria

By: trelleborg

trelleborg — Thu, 08 Dec 2005 08:21:19 +0000

The encryption was done with win xp pro’s built in encrypton option. We are in an active directory system, but it seems we have no recovery agent in our sub domain.

By: netsecadmin

netsecadmin — Wed, 07 Dec 2005 21:34:21 +0000

If you do not have the decryption keys, I would say you are out of luck.
What was the data encrypted with? Software X? MS EFS? Any known data recovery keys defined?….

If it was properly done, you will not decrypt data if you do not have defined recovery methods and keys. If you can decrypt without these, throw away the encryption software once data is recovered.