 |
Page 1 of 2
|
| Author |
Message |
JonathanBVI
Joined: 14 Jun 2007
Posts: 6
|
 What is the path to recover Encryption keys from Formatted..
I have a customers' PC that has a folder that is encrypted and gives "Access
denied" because of the XP (Pro SP2) Encryption (it is not an ownership
issue). The HD that contained the windows installation has been reformatted,
and the user had not backed up the certificates/keys, or put a RA in place. I
have used a data recovery tool to recover the Documents & Settings folder
from the reformatted drive and there are a number of certificates & keys that
successfully import, but sadly the folder will still not decrypt.
Q1 - Is Documents & Settings the only path I need to restore from the
Formatted drive, or is there somewhere (something) else I need as well.
Q2 - How can I find out what Key was used to encrypt the folder & ensure I
have it imported.
Many thanks for your advise.
|
| Mon May 14, 2007 4:44 am |
|
 |
JonathanBVI
Joined: 14 Jun 2007
Posts: 6
|
 What is the path to recover Encryption keys from Formatted..
I have a customers' PC that has a folder that is encrypted and gives "Access
denied" because of the XP (Pro SP2) Encryption (it is not an ownership
issue). The HD that contained the windows installation has been reformatted,
and the user had not backed up the certificates/keys, or put a RA in place. I
have used a data recovery tool to recover the Documents & Settings folder
from the reformatted drive and there are a number of certificates & keys that
successfully import, but sadly the folder will still not decrypt.
Q1 - Is Documents & Settings the only path I need to restore from the
Formatted drive, or is there somewhere (something) else I need as well.
Q2 - How can I find out what Key was used to encrypt the folder & ensure I
have it imported.
Many thanks for your advise.
|
| Mon May 14, 2007 4:44 am |
|
 |
Malke
Joined: 08 Apr 2007
Posts: 525
|
 What is the path to recover Encryption keys from Formatted..
JonathanBVI wrote:
> I have a customers' PC that has a folder that is encrypted and gives "Access
> denied" because of the XP (Pro SP2) Encryption (it is not an ownership
> issue). The HD that contained the windows installation has been reformatted,
> and the user had not backed up the certificates/keys, or put a RA in place. I
> have used a data recovery tool to recover the Documents & Settings folder
> from the reformatted drive and there are a number of certificates & keys that
> successfully import, but sadly the folder will still not decrypt.
> Q1 - Is Documents & Settings the only path I need to restore from the
> Formatted drive, or is there somewhere (something) else I need as well.
> Q2 - How can I find out what Key was used to encrypt the folder & ensure I
> have it imported.
>
> Many thanks for your advise.
>
>
You can't. If your customer neglected to back up his keys and/or set a
recovery agent, then the data is inaccessible forever. You might get
some help from the Elcomsoft program, but from your description of the
situation (drive formatted), I doubt it.
http://tinyurl.com/6l6xx - MS information about EFS (Encryption)
http://www.elcomsoft.com/aefsdr.html - Encrypted files retrieval application
Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User
|
| Mon May 14, 2007 7:40 am |
|
 |
Malke
Joined: 08 Apr 2007
Posts: 525
|
 What is the path to recover Encryption keys from Formatted..
JonathanBVI wrote:
> I have a customers' PC that has a folder that is encrypted and gives "Access
> denied" because of the XP (Pro SP2) Encryption (it is not an ownership
> issue). The HD that contained the windows installation has been reformatted,
> and the user had not backed up the certificates/keys, or put a RA in place. I
> have used a data recovery tool to recover the Documents & Settings folder
> from the reformatted drive and there are a number of certificates & keys that
> successfully import, but sadly the folder will still not decrypt.
> Q1 - Is Documents & Settings the only path I need to restore from the
> Formatted drive, or is there somewhere (something) else I need as well.
> Q2 - How can I find out what Key was used to encrypt the folder & ensure I
> have it imported.
>
> Many thanks for your advise.
>
>
You can't. If your customer neglected to back up his keys and/or set a
recovery agent, then the data is inaccessible forever. You might get
some help from the Elcomsoft program, but from your description of the
situation (drive formatted), I doubt it.
http://tinyurl.com/6l6xx - MS information about EFS (Encryption)
http://www.elcomsoft.com/aefsdr.html - Encrypted files retrieval application
Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User
|
| Mon May 14, 2007 7:40 am |
|
 |
Vanguard
Joined: 05 May 2007
Posts: 44
|
 What is the path to recover Encryption keys from Formatted..
"JonathanBVI" <JonathanBVI.TakeThisOut@discussions.microsoft.com> wrote in message
news:919AEE68-C21B-4207-97E7-00DA5D39E514@microsoft.com...
>I have a customers' PC that has a folder that is encrypted and gives
>"Access
> denied" because of the XP (Pro SP2) Encryption (it is not an ownership
> issue). The HD that contained the windows installation has been
> reformatted,
> and the user had not backed up the certificates/keys, or put a RA in
> place. I
> have used a data recovery tool to recover the Documents & Settings
> folder
> from the reformatted drive and there are a number of certificates &
> keys that
> successfully import, but sadly the folder will still not decrypt.
> Q1 - Is Documents & Settings the only path I need to restore from the
> Formatted drive, or is there somewhere (something) else I need as
> well.
> Q2 - How can I find out what Key was used to encrypt the folder &
> ensure I
> have it imported.
>
> Many thanks for your advise.
>
>
There is no backdoor to EFS other than a massive bank of number
crunching hosts to decode encrypted files, and you don't have access to
that. Your customer lost their files by not knowing how to use EFS,
like exporting the EFS certificate or designating a recovery agent. You
can't fix a tool improperly used by your customer.
You mention "restore". So did the customer do backups?
|
| Mon May 14, 2007 9:45 pm |
|
 |
Vanguard
Joined: 05 May 2007
Posts: 44
|
 What is the path to recover Encryption keys from Formatted..
"JonathanBVI" <JonathanBVI.DeleteThis@discussions.microsoft.com> wrote in message
news:919AEE68-C21B-4207-97E7-00DA5D39E514@microsoft.com...
>I have a customers' PC that has a folder that is encrypted and gives
>"Access
> denied" because of the XP (Pro SP2) Encryption (it is not an ownership
> issue). The HD that contained the windows installation has been
> reformatted,
> and the user had not backed up the certificates/keys, or put a RA in
> place. I
> have used a data recovery tool to recover the Documents & Settings
> folder
> from the reformatted drive and there are a number of certificates &
> keys that
> successfully import, but sadly the folder will still not decrypt.
> Q1 - Is Documents & Settings the only path I need to restore from the
> Formatted drive, or is there somewhere (something) else I need as
> well.
> Q2 - How can I find out what Key was used to encrypt the folder &
> ensure I
> have it imported.
>
> Many thanks for your advise.
>
>
There is no backdoor to EFS other than a massive bank of number
crunching hosts to decode encrypted files, and you don't have access to
that. Your customer lost their files by not knowing how to use EFS,
like exporting the EFS certificate or designating a recovery agent. You
can't fix a tool improperly used by your customer.
You mention "restore". So did the customer do backups?
|
| Mon May 14, 2007 9:45 pm |
|
 |
Harry Johnston
Joined: 06 Oct 2007
Posts: 5
|
 What is the path to recover Encryption keys from Formatted..
JonathanBVI wrote:
> [...] used a data recovery tool to recover the Documents & Settings folder
> from the reformatted drive and there are a number of certificates & keys that
> successfully import, but sadly the folder will still not decrypt.
I don't know whether it is possible to recover encrypted data by importing keys
from a recovered Documents and Settings folder. If it is, however, it will also
be necessary to ensure that the user account password is the same as the one
that was originally set. The key used to decrypt encrypted data is itself
encrypted with the user account password.
Harry.
|
| Tue May 15, 2007 7:05 am |
|
 |
Harry Johnston
Joined: 06 Oct 2007
Posts: 5
|
 What is the path to recover Encryption keys from Formatted..
JonathanBVI wrote:
> [...] used a data recovery tool to recover the Documents & Settings folder
> from the reformatted drive and there are a number of certificates & keys that
> successfully import, but sadly the folder will still not decrypt.
I don't know whether it is possible to recover encrypted data by importing keys
from a recovered Documents and Settings folder. If it is, however, it will also
be necessary to ensure that the user account password is the same as the one
that was originally set. The key used to decrypt encrypted data is itself
encrypted with the user account password.
Harry.
|
| Tue May 15, 2007 7:05 am |
|
 |
JonathanBVI
Joined: 14 Jun 2007
Posts: 6
|
 What is the path to recover Encryption keys from Formatted..
When I talk about Restore, I am talking about the files I recovered from the
formatted hard drive using "EASEUS Data Recovery Wizard Professional 3.3.4"
(a great tool). My fault for using the wrong word.
My original questions were not looking to find a back door. Just to clarify
where within the directory structure the keys are stored, so that I can
ensure I have got everything.
I am probably being very naive, but my understanding is that if I can
recover the keys from the formatted HD (hence where are they kept), Apply the
original password used (I know that) and I should be able to decrypt the
folder. But after a lot of searching & Asking I still have no idea where the
keys are kept, within a windows XP path structure.
Maybee the answer is "there are no files held on the disk", because they are
all held as data within the registry.
"Vanguard" wrote:
> "JonathanBVI" <JonathanBVI.RemoveThis@discussions.microsoft.com> wrote in message
> news:919AEE68-C21B-4207-97E7-00DA5D39E514@microsoft.com...
> >I have a customers' PC that has a folder that is encrypted and gives
> >"Access
> > denied" because of the XP (Pro SP2) Encryption (it is not an ownership
> > issue). The HD that contained the windows installation has been
> > reformatted,
> > and the user had not backed up the certificates/keys, or put a RA in
> > place. I
> > have used a data recovery tool to recover the Documents & Settings
> > folder
> > from the reformatted drive and there are a number of certificates &
> > keys that
> > successfully import, but sadly the folder will still not decrypt.
> > Q1 - Is Documents & Settings the only path I need to restore from the
> > Formatted drive, or is there somewhere (something) else I need as
> > well.
> > Q2 - How can I find out what Key was used to encrypt the folder &
> > ensure I
> > have it imported.
> >
> > Many thanks for your advise.
> >
> >
>
>
> There is no backdoor to EFS other than a massive bank of number
> crunching hosts to decode encrypted files, and you don't have access to
> that. Your customer lost their files by not knowing how to use EFS,
> like exporting the EFS certificate or designating a recovery agent. You
> can't fix a tool improperly used by your customer.
>
> You mention "restore". So did the customer do backups?
>
>
|
| Wed May 16, 2007 11:09 am |
|
 |
JonathanBVI
Joined: 14 Jun 2007
Posts: 6
|
 What is the path to recover Encryption keys from Formatted..
When I talk about Restore, I am talking about the files I recovered from the
formatted hard drive using "EASEUS Data Recovery Wizard Professional 3.3.4"
(a great tool). My fault for using the wrong word.
My original questions were not looking to find a back door. Just to clarify
where within the directory structure the keys are stored, so that I can
ensure I have got everything.
I am probably being very naive, but my understanding is that if I can
recover the keys from the formatted HD (hence where are they kept), Apply the
original password used (I know that) and I should be able to decrypt the
folder. But after a lot of searching & Asking I still have no idea where the
keys are kept, within a windows XP path structure.
Maybee the answer is "there are no files held on the disk", because they are
all held as data within the registry.
"Vanguard" wrote:
> "JonathanBVI" <JonathanBVI.DeleteThis@discussions.microsoft.com> wrote in message
> news:919AEE68-C21B-4207-97E7-00DA5D39E514@microsoft.com...
> >I have a customers' PC that has a folder that is encrypted and gives
> >"Access
> > denied" because of the XP (Pro SP2) Encryption (it is not an ownership
> > issue). The HD that contained the windows installation has been
> > reformatted,
> > and the user had not backed up the certificates/keys, or put a RA in
> > place. I
> > have used a data recovery tool to recover the Documents & Settings
> > folder
> > from the reformatted drive and there are a number of certificates &
> > keys that
> > successfully import, but sadly the folder will still not decrypt.
> > Q1 - Is Documents & Settings the only path I need to restore from the
> > Formatted drive, or is there somewhere (something) else I need as
> > well.
> > Q2 - How can I find out what Key was used to encrypt the folder &
> > ensure I
> > have it imported.
> >
> > Many thanks for your advise.
> >
> >
>
>
> There is no backdoor to EFS other than a massive bank of number
> crunching hosts to decode encrypted files, and you don't have access to
> that. Your customer lost their files by not knowing how to use EFS,
> like exporting the EFS certificate or designating a recovery agent. You
> can't fix a tool improperly used by your customer.
>
> You mention "restore". So did the customer do backups?
>
>
|
| Wed May 16, 2007 11:09 am |
|
 |
Poprivet
Joined: 05 Jul 2007
Posts: 60
|
 What is the path to recover Encryption keys from Formatted..
JonathanBVI wrote:
> When I talk about Restore, I am talking about the files I recovered
> from the formatted hard drive using "EASEUS Data Recovery Wizard
> Professional 3.3.4" (a great tool). My fault for using the wrong word.
>
> My original questions were not looking to find a back door. Just to
> clarify where within the directory structure the keys are stored, so
> that I can ensure I have got everything.
>
> I am probably being very naive, but my understanding is that if I can
> recover the keys from the formatted HD (hence where are they kept),
> Apply the original password used (I know that) and I should be able
> to decrypt the folder. But after a lot of searching & Asking I still
> have no idea where the keys are kept, within a windows XP path
> structure.
> Maybee the answer is "there are no files held on the disk", because
> they are all held as data within the registry.
>
Not to be a nay-sayer, but I've had personal experience a couple years ago;
I didn't create the disk so I could move the files or reinstall, etc..
I hope you succeed but my research at that time and readings since
indicated they couldn't be recovered. Even with the same user info and
setups on the other computer, the internal keys are all different (almost
random when created, I think) and are very hard to break. Not that I
understand it all or even remember it very well. It's apparently a pretty
good protection method <g>.
Have you checked with the user just in case they did make the key disk?
Pop'
>
>
>
>
>
>
>
>
>
>
> "Vanguard" wrote:
>
>> "JonathanBVI" <JonathanBVI.TakeThisOut@discussions.microsoft.com> wrote in
>> message news:919AEE68-C21B-4207-97E7-00DA5D39E514@microsoft.com...
>>> I have a customers' PC that has a folder that is encrypted and gives
>>> "Access
>>> denied" because of the XP (Pro SP2) Encryption (it is not an
>>> ownership issue). The HD that contained the windows installation
>>> has been reformatted,
>>> and the user had not backed up the certificates/keys, or put a RA in
>>> place. I
>>> have used a data recovery tool to recover the Documents & Settings
>>> folder
>>> from the reformatted drive and there are a number of certificates &
>>> keys that
>>> successfully import, but sadly the folder will still not decrypt.
>>> Q1 - Is Documents & Settings the only path I need to restore from
>>> the Formatted drive, or is there somewhere (something) else I need
>>> as well.
>>> Q2 - How can I find out what Key was used to encrypt the folder &
>>> ensure I
>>> have it imported.
>>>
>>> Many thanks for your advise.
>>>
>>>
>>
>>
>> There is no backdoor to EFS other than a massive bank of number
>> crunching hosts to decode encrypted files, and you don't have access
>> to that. Your customer lost their files by not knowing how to use
>> EFS, like exporting the EFS certificate or designating a recovery
>> agent. You can't fix a tool improperly used by your customer.
>>
>> You mention "restore". So did the customer do backups?
|
| Thu May 17, 2007 12:02 pm |
|
 |
Poprivet
Joined: 05 Jul 2007
Posts: 60
|
 What is the path to recover Encryption keys from Formatted..
JonathanBVI wrote:
> When I talk about Restore, I am talking about the files I recovered
> from the formatted hard drive using "EASEUS Data Recovery Wizard
> Professional 3.3.4" (a great tool). My fault for using the wrong word.
>
> My original questions were not looking to find a back door. Just to
> clarify where within the directory structure the keys are stored, so
> that I can ensure I have got everything.
>
> I am probably being very naive, but my understanding is that if I can
> recover the keys from the formatted HD (hence where are they kept),
> Apply the original password used (I know that) and I should be able
> to decrypt the folder. But after a lot of searching & Asking I still
> have no idea where the keys are kept, within a windows XP path
> structure.
> Maybee the answer is "there are no files held on the disk", because
> they are all held as data within the registry.
>
Not to be a nay-sayer, but I've had personal experience a couple years ago;
I didn't create the disk so I could move the files or reinstall, etc..
I hope you succeed but my research at that time and readings since
indicated they couldn't be recovered. Even with the same user info and
setups on the other computer, the internal keys are all different (almost
random when created, I think) and are very hard to break. Not that I
understand it all or even remember it very well. It's apparently a pretty
good protection method <g>.
Have you checked with the user just in case they did make the key disk?
Pop'
>
>
>
>
>
>
>
>
>
>
> "Vanguard" wrote:
>
>> "JonathanBVI" <JonathanBVI RemoveThis @discussions.microsoft.com> wrote in
>> message news:919AEE68-C21B-4207-97E7-00DA5D39E514@microsoft.com...
>>> I have a customers' PC that has a folder that is encrypted and gives
>>> "Access
>>> denied" because of the XP (Pro SP2) Encryption (it is not an
>>> ownership issue). The HD that contained the windows installation
>>> has been reformatted,
>>> and the user had not backed up the certificates/keys, or put a RA in
>>> place. I
>>> have used a data recovery tool to recover the Documents & Settings
>>> folder
>>> from the reformatted drive and there are a number of certificates &
>>> keys that
>>> successfully import, but sadly the folder will still not decrypt.
>>> Q1 - Is Documents & Settings the only path I need to restore from
>>> the Formatted drive, or is there somewhere (something) else I need
>>> as well.
>>> Q2 - How can I find out what Key was used to encrypt the folder &
>>> ensure I
>>> have it imported.
>>>
>>> Many thanks for your advise.
>>>
>>>
>>
>>
>> There is no backdoor to EFS other than a massive bank of number
>> crunching hosts to decode encrypted files, and you don't have access
>> to that. Your customer lost their files by not knowing how to use
>> EFS, like exporting the EFS certificate or designating a recovery
>> agent. You can't fix a tool improperly used by your customer.
>>
>> You mention "restore". So did the customer do backups?
|
| Thu May 17, 2007 12:02 pm |
|
 |
JonathanBVI
Joined: 14 Jun 2007
Posts: 6
|
 What is the path to recover Encryption keys from Formatted..
Thanks for the reply.
The customer had no idea what they were doing "It looked like a good option
to tick"!!! so no way would a key backup have been taken.
I tend to agree that the data should be regarded as lost. I needed to ask
the question, so that I could feel comfortable with saying all is lost.
Regards
Jonathan
"Poprivet" wrote:
> JonathanBVI wrote:
> > When I talk about Restore, I am talking about the files I recovered
> > from the formatted hard drive using "EASEUS Data Recovery Wizard
> > Professional 3.3.4" (a great tool). My fault for using the wrong word.
> >
> > My original questions were not looking to find a back door. Just to
> > clarify where within the directory structure the keys are stored, so
> > that I can ensure I have got everything.
> >
> > I am probably being very naive, but my understanding is that if I can
> > recover the keys from the formatted HD (hence where are they kept),
> > Apply the original password used (I know that) and I should be able
> > to decrypt the folder. But after a lot of searching & Asking I still
> > have no idea where the keys are kept, within a windows XP path
> > structure.
> > Maybee the answer is "there are no files held on the disk", because
> > they are all held as data within the registry.
>
> >
> Not to be a nay-sayer, but I've had personal experience a couple years ago;
> I didn't create the disk so I could move the files or reinstall, etc..
> I hope you succeed but my research at that time and readings since
> indicated they couldn't be recovered. Even with the same user info and
> setups on the other computer, the internal keys are all different (almost
> random when created, I think) and are very hard to break. Not that I
> understand it all or even remember it very well. It's apparently a pretty
> good protection method <g>.
>
> Have you checked with the user just in case they did make the key disk?
>
> Pop'
>
>
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> > "Vanguard" wrote:
> >
> >> "JonathanBVI" <JonathanBVI.RemoveThis@discussions.microsoft.com> wrote in
> >> message news:919AEE68-C21B-4207-97E7-00DA5D39E514@microsoft.com...
> >>> I have a customers' PC that has a folder that is encrypted and gives
> >>> "Access
> >>> denied" because of the XP (Pro SP2) Encryption (it is not an
> >>> ownership issue). The HD that contained the windows installation
> >>> has been reformatted,
> >>> and the user had not backed up the certificates/keys, or put a RA in
> >>> place. I
> >>> have used a data recovery tool to recover the Documents & Settings
> >>> folder
> >>> from the reformatted drive and there are a number of certificates &
> >>> keys that
> >>> successfully import, but sadly the folder will still not decrypt.
> >>> Q1 - Is Documents & Settings the only path I need to restore from
> >>> the Formatted drive, or is there somewhere (something) else I need
> >>> as well.
> >>> Q2 - How can I find out what Key was used to encrypt the folder &
> >>> ensure I
> >>> have it imported.
> >>>
> >>> Many thanks for your advise.
> >>>
> >>>
> >>
> >>
> >> There is no backdoor to EFS other than a massive bank of number
> >> crunching hosts to decode encrypted files, and you don't have access
> >> to that. Your customer lost their files by not knowing how to use
> >> EFS, like exporting the EFS certificate or designating a recovery
> >> agent. You can't fix a tool improperly used by your customer.
> >>
> >> You mention "restore". So did the customer do backups?
>
>
>
>
|
| Thu May 17, 2007 12:13 pm |
|
 |
JonathanBVI
Joined: 14 Jun 2007
Posts: 6
|
 What is the path to recover Encryption keys from Formatted..
Thanks for the reply.
The customer had no idea what they were doing "It looked like a good option
to tick"!!! so no way would a key backup have been taken.
I tend to agree that the data should be regarded as lost. I needed to ask
the question, so that I could feel comfortable with saying all is lost.
Regards
Jonathan
"Poprivet" wrote:
> JonathanBVI wrote:
> > When I talk about Restore, I am talking about the files I recovered
> > from the formatted hard drive using "EASEUS Data Recovery Wizard
> > Professional 3.3.4" (a great tool). My fault for using the wrong word.
> >
> > My original questions were not looking to find a back door. Just to
> > clarify where within the directory structure the keys are stored, so
> > that I can ensure I have got everything.
> >
> > I am probably being very naive, but my understanding is that if I can
> > recover the keys from the formatted HD (hence where are they kept),
> > Apply the original password used (I know that) and I should be able
> > to decrypt the folder. But after a lot of searching & Asking I still
> > have no idea where the keys are kept, within a windows XP path
> > structure.
> > Maybee the answer is "there are no files held on the disk", because
> > they are all held as data within the registry.
>
> >
> Not to be a nay-sayer, but I've had personal experience a couple years ago;
> I didn't create the disk so I could move the files or reinstall, etc..
> I hope you succeed but my research at that time and readings since
> indicated they couldn't be recovered. Even with the same user info and
> setups on the other computer, the internal keys are all different (almost
> random when created, I think) and are very hard to break. Not that I
> understand it all or even remember it very well. It's apparently a pretty
> good protection method <g>.
>
> Have you checked with the user just in case they did make the key disk?
>
> Pop'
>
>
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> > "Vanguard" wrote:
> >
> >> "JonathanBVI" <JonathanBVI DeleteThis @discussions.microsoft.com> wrote in
> >> message news:919AEE68-C21B-4207-97E7-00DA5D39E514@microsoft.com...
> >>> I have a customers' PC that has a folder that is encrypted and gives
> >>> "Access
> >>> denied" because of the XP (Pro SP2) Encryption (it is not an
> >>> ownership issue). The HD that contained the windows installation
> >>> has been reformatted,
> >>> and the user had not backed up the certificates/keys, or put a RA in
> >>> place. I
> >>> have used a data recovery tool to recover the Documents & Settings
> >>> folder
> >>> from the reformatted drive and there are a number of certificates &
> >>> keys that
> >>> successfully import, but sadly the folder will still not decrypt.
> >>> Q1 - Is Documents & Settings the only path I need to restore from
> >>> the Formatted drive, or is there somewhere (something) else I need
> >>> as well.
> >>> Q2 - How can I find out what Key was used to encrypt the folder &
> >>> ensure I
> >>> have it imported.
> >>>
> >>> Many thanks for your advise.
> >>>
> >>>
> >>
> >>
> >> There is no backdoor to EFS other than a massive bank of number
> >> crunching hosts to decode encrypted files, and you don't have access
> >> to that. Your customer lost their files by not knowing how to use
> >> EFS, like exporting the EFS certificate or designating a recovery
> >> agent. You can't fix a tool improperly used by your customer.
> >>
> >> You mention "restore". So did the customer do backups?
>
>
>
>
|
| Thu May 17, 2007 12:13 pm |
|
 |
Vanguard
Joined: 05 May 2007
Posts: 44
|
 What is the path to recover Encryption keys from Formatted..
"JonathanBVI" wrote in message
news:F7B2C927-9E73-4737-BD92-1490CF6167EE@microsoft.com...
>
> "Vanguard" wrote:
>
>> "JonathanBVI" wrote ...
>> >I have a customers' PC that has a folder that is encrypted and gives
>> >"Access
>> > denied" because of the XP (Pro SP2) Encryption (it is not an
>> > ownership
>> > issue). The HD that contained the windows installation has been
>> > reformatted,
>> > and the user had not backed up the certificates/keys, or put a RA
>> > in
>> > place. I
>> > have used a data recovery tool to recover the Documents & Settings
>> > folder
>> > from the reformatted drive and there are a number of certificates &
>> > keys that
>> > successfully import, but sadly the folder will still not decrypt.
>> > Q1 - Is Documents & Settings the only path I need to restore from
>> > the
>> > Formatted drive, or is there somewhere (something) else I need as
>> > well.
>> > Q2 - How can I find out what Key was used to encrypt the folder &
>> > ensure I
>> > have it imported.
>>
>> There is no backdoor to EFS other than a massive bank of number
>> crunching hosts to decode encrypted files, and you don't have access
>> to
>> that. Your customer lost their files by not knowing how to use EFS,
>> like exporting the EFS certificate or designating a recovery agent.
>> You
>> can't fix a tool improperly used by your customer.
>>
>> You mention "restore". So did the customer do backups?
>
> When I talk about Restore, I am talking about the files I recovered
> from the
> formatted hard drive using "EASEUS Data Recovery Wizard Professional
> 3.3.4"
> (a great tool). My fault for using the wrong word.
>
> My original questions were not looking to find a back door. Just to
> clarify
> where within the directory structure the keys are stored, so that I
> can
> ensure I have got everything.
>
> I am probably being very naive, but my understanding is that if I can
> recover the keys from the formatted HD (hence where are they kept),
> Apply the
> original password used (I know that) and I should be able to decrypt
> the
> folder. But after a lot of searching & Asking I still have no idea
> where the
> keys are kept, within a windows XP path structure.
> Maybee the answer is "there are no files held on the disk", because
> they are
> all held as data within the registry.
Ask your customer how much they are willing to recover the data. Then
look at http://www.elcomsoft.com/aefsdr.html. I believe the trial
version only tells you if you could recover the files but doesn't
actually recover them until you buy their product but you'll have to
check for yourself. I've heard of this one but never used it.
|
| Sat May 19, 2007 10:59 pm |
|
 |
|
|
The time now is Sun Nov 23, 2008 9:58 am | All times are GMT
|
Page 1 of 2
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
|
|