Solved

EFS Recovery

Posted on 2006-10-20
8
530 Views
Last Modified: 2008-02-01
Hello.

I've encypted some files under Windows XP about a while ago, and I very recently FORMATTED my drive (after backing up the data, and dumbly enough, I didn't backup the encryption key for the files) and installed Windows Vista RC2.

I've tried about 4 solutions found here on experts-exchange, I'm losing hope that software might help decrypt them if I had my old username/password, so it looks to me like I'm gonna have to brute-force it.

I've also read somewhere that having the SID too might do great help in recovering the data.

If there's no easier way, I'd like to brute-force it with rainbow tables, even if it takes too long, I've got time. Only problem is, I'm not at all familiar with that procedure.

NOTE: I've also read that copying the encrypted files on a FAT32 drive will recover them. Except, I've tried that, and it said that I needed permission from "S-1-5-21-1078081533-117609710-725345543-1003", which supposedly is my old SID. Here's a screenshot: http://www.myroomstore.com/denied.jpg

So here's all I have that might help my case: username, password, and SID.
0
Comment
Question by:WilimarLynwood
  • 5
  • 3
8 Comments
 
LVL 59

Expert Comment

by:LeeTutor
ID: 17776689
If you didn't designate a Recovery Agent or export your certificate and private key, according to Microsoft you cannot restore the encrypted file:

http://support.microsoft.com/default.aspx?scid=kb;en-us;308993
HOW TO: Remove File Encryption in Windows XP

However, I've seen Previously Answered Questions on this site that say this program (which is, unfortunately, not free) will work:

http://www.elcomsoft.com/aefsdr.html
0
 
LVL 1

Author Comment

by:WilimarLynwood
ID: 17776840
I've heard that you are able to brute-force the whole process, try every possible password, and as long as its less than 32-characters long, it will eventually get the right encryption key. (using software for that, of course)
0
 
LVL 1

Author Comment

by:WilimarLynwood
ID: 17776856
Plus, I like to think what Microsoft says is usually bs. :)
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 17776974
That is probably what the program does.  But here is another page I found on EFS recovery:

http://articles.techrepublic.com.com/5100-6346_11-5035070.html

contains this interesting quotation:

EFS protects data stored on a local NTFS partition. It does not protect data when it is sent across a network. This is a big issue. Because EFS was designed to be transparent to end users, when the user who encrypted the file copies it across the network or sends it via e-mail, the file is automatically decrypted before it is sent across the network so that it can be readable on the target system. For a user who does not understand this, and believes that his or her sensitive data is secure, the mistake can be costly.
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 1

Author Comment

by:WilimarLynwood
ID: 17777344
I forgot to add that I tried that program, and it didn't give me any results. I tried adding my username and password, the admin password, etc.. but nothing (I'm guess due to the fact that I formatted my primary drive that had the OS).

And about that part in the article, that's not possible for me since it gives me an "Access denied" message whenever I try to copy the files, even to the same drive.

I've also tried doing it in MS-DOS before loading Windows, and I couldn't copy any files.
0
 
LVL 59

Accepted Solution

by:
LeeTutor earned 275 total points
ID: 17777558
Have you tried taking ownership to see if the "access denied" message can be eliminated?  Go to Documents and Settings on the old drive
Right Click the user folder and select Properties
Go to the Security Tab
Select Advanced
Go to the Owner tab
Select "take ownership"
Once ownership is taken, you can give yourself permissions.

Note: this only works if you are an administrator on the machine.

More info: see these MSKB articles:

http://support.microsoft.com/default.aspx?scid=kb;en-us;308421
HOW TO: Take Ownership of a File or Folder in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;308418
HOW TO: Set, View, Change, or Remove File and Folder Permissions in Windows XP

If you don't see the Security tab, you will have to first disable Simple File Sharing in Windows XP Pro by clicking the Tools menu in Windows Explorer, selecting Folder Options, then the View tab, and then removing the check mark next to Use Simple File Sharing.  If you are using XP Home, then you will need to boot into Safe mode and login as Administrator to access the Security tab.
0
 
LVL 1

Author Comment

by:WilimarLynwood
ID: 17777593
For your first comment, I changed the ownership to "v\Wilimar Lynwood" which is the account I'm currently on, but still, when I try to copy a file to the other drive, it gives me an error message saying "You require permission from v\Wilimar Lynwood to make changes to this file" (even though I'm not making any changes, and oddly enough, I am "Wilimar Lynwood" on "v" (computer name is v)
0
 
LVL 1

Author Comment

by:WilimarLynwood
ID: 17825242
I guess there's no solution to this. I've decided to just suck it up and delete my encrpted files =).

But, thanks alot for your input anyway, the points are yours.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

If you build your web application in Visual Studio you'll get at least a few binaries, or .DLL, files in your bin folder. However, there is more compiling to be done. Normally this would happen when an ASP.NET resource within the web site is request…
Ok I have been working on this for some time having learned and gained certification in XenDesktop 4 along came version 5 which was released last month. Since then I have been working to deploy XenDesktop 5 in a small environment with only 2 virt…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now