Facebook   Twitter    YouTube    RSS Feed    Android App    iPhone and iPad App     BlackBerry App    
Subscribe to Newsletter



Results 1 to 10 of 10

Thread: How to recover encrypted files, if lost encryption key/certificate

  1. #1

    Question How to recover encrypted files, if lost encryption key/certificate

    Hi,

    I have lost my laptop, which had encrypted data files in the "My Docs" folder. However I backed up this data on an external hard drive.

    But now I cannot access (open, copy, etc) these files on the external hard drive, since it is also encrypted; and I do not have the encryption key/certificate!

    Anyone know if its at all possible to recover this data? I am using win xp.

    Thanks

  2. #2
    Super Grandmaster
    Join Date
    Jan 2006
    Location
    Lonehill
    Posts
    16,835

    Default

    What encryption program did you use?

  3. #3

    Default

    I dont know, it was automatically encrypted. (i guess this doesnt help ). All i know is that encrypted files, show the filename in a green font, and all other files show as normal black font.
    Last edited by Kompete; 03-07-2008 at 08:39 PM.

  4. #4

    Default

    kompete, i know of no way unless you have backed up the certificates..
    if you find out, let us all know

    edit: kompete, if it showed as green etc, then you were using EFS on windows xp. (Encrypted File System)
    maybe start by googling that..
    I hang about at vernsvapes.com. Use:stingray/nemesis, vtc4, quasar/3d dripper

  5. #5

    Default

    So there is no software one can buy to do this either?

    If there are any hackers here that can do this and want to make a quick buck pm me. I am desperate and willing to throw money at this problem. This is all my personal data files, so its all legal.

    thx

  6. #6

    Default

    Quote Originally Posted by Kompete View Post
    If there are any hackers here that can do this and want to make a quick buck pm me. I am desperate and willing to throw money at this problem. This is all my personal data files, so its all legal.
    Can't be done unless you're idea of "throwing money at it" is way north of R300 000.

    To hack XP encryption you need the sys key and the user password. The user pwd you probably have, the sys key you don't. Even with those, it would require someone with serious skill (beyond what anyone on this board has imo).

    Quote Originally Posted by Kompete View Post
    But now I cannot access (open, copy, etc) these files on the external hard drive,
    Now that sounds more promising...cause that sounds more like a simple FS permission issue. Files will usually lose their encryption if you move them out of the My Docs folder. Explain in detail what you mean by "cannot access"...what does it say exactly?
    Quote Originally Posted by HavocXphere View Post
    I decided yesterday that its winter now.
    Quote Originally Posted by Picard View Post
    Thank you God/Havoc ...

  7. #7

    Default

    Quote Originally Posted by HavocXphere View Post
    Can't be done unless you're idea of "throwing money at it" is way north of R300 000.
    Hmmm...little steep, was hoping I could do this for under R10k

    Quote Originally Posted by HavocXphere View Post
    Now that sounds more promising...cause that sounds more like a simple FS permission issue. Files will usually lose their encryption if you move them out of the My Docs folder. Explain in detail what you mean by "cannot access"...what does it say exactly?
    What I mean with cannot access the files is: I can see the file names, extensions, size etc (i.e. its not hidden); the font colour is green; I can right click the file and open properties, but that is all I can do...I cannot open it (get a message saying "user does not have access privileges or access denied", I also cannot copy or move the files.

    Also, you are right that the files should have lost their encryption if you move them out of the My Docs folder (since when I copied files onto flashdisk it worked fine); but somehow it didnt loose its encryption when I copied it onto my Maxtor external disk

  8. #8

    Default

    kompete, lets assume they lost their encyption, and life is just confusing, so we may as well try something.

    what you describe (besides the green colour) often happens when you reinstall and try get files back, or plug a driv ein from another machine, and it is to do with file permission.

    essentially, your user account was kompete/pc1
    and now it is kompete/pc2

    so it is a different user.

    but assuming you are an admin, you can "take ownership" of these files.

    do this
    http://support.microsoft.com/kb/308421

    but note: on xp home only you have to do it in safe mode

    it if works, send R10 to the nearest charity, or buy a homeless bloke some bread and milk.

    cheers
    werner
    I hang about at vernsvapes.com. Use:stingray/nemesis, vtc4, quasar/3d dripper

  9. #9

    Default

    Thx mate will give it a shot...if it doesnt work, I'm seeing a data recovery specialist tomorrow. Will let you all know.

  10. #10

    Default

    This appears to promise what you need...but I wouldn't hold my breath cause I'm pretty sure that app needs the windows installation to be available to grab the sys key/salt. Worth a shot though.

    It all depends on how the EFS key is calculated. If its just based on the user password, then its going to be easy...but this is unlikely unless the HR department does the encryption code for MS. Chances are high that it is somehow salted with the sys key or something like that. That would mean you have to break a 128 bit AES key to get to the files...which is where the R300k estimate comes in (plus minus a zero).

    the font colour is green


    Will let you all know.
    Please do so. I'd be interested in the outcome of this.

    Good luck with the recovery specialist....hopefully he knows something I don't.
    Quote Originally Posted by HavocXphere View Post
    I decided yesterday that its winter now.
    Quote Originally Posted by Picard View Post
    Thank you God/Havoc ...

Bookmarks

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •