How to recover encrypted files, if lost encryption key/certificate

[Kompete]

Hi,

I have lost my laptop, which had encrypted data files in the "My Docs" folder. However I backed up this data on an external hard drive.

But now I cannot access (open, copy, etc) these files on the external hard drive, since it is also encrypted; and I do not have the encryption key/certificate!

Anyone know if its at all possible to recover this data? I am using win xp.

Thanks

 

[Syndyre]

What encryption program did you use?

 

[Kompete]

I dont know, it was automatically encrypted. (i guess this doesnt help ). All i know is that encrypted files, show the filename in a green font, and all other files show as normal black font.

 

[werner]

kompete, i know of no way unless you have backed up the certificates..
if you find out, let us all know

edit: kompete, if it showed as green etc, then you were using EFS on windows xp. (Encrypted File System)
maybe start by googling that..

 

[Kompete]

So there is no software one can buy to do this either?

If there are any hackers here that can do this and want to make a quick buck pm me. I am desperate and willing to throw money at this problem. This is all my personal data files, so its all legal.

thx

 

[HavocXphere]

If there are any hackers here that can do this and want to make a quick buck pm me. I am desperate and willing to throw money at this problem. This is all my personal data files, so its all legal.

Can't be done unless you're idea of "throwing money at it" is way north of R300 000.

To hack XP encryption you need the sys key and the user password. The user pwd you probably have, the sys key you don't. Even with those, it would require someone with serious skill (beyond what anyone on this board has imo).

But now I cannot access (open, copy, etc) these files on the external hard drive,

Now that sounds more promising...cause that sounds more like a simple FS permission issue. Files will usually lose their encryption if you move them out of the My Docs folder. Explain in detail what you mean by "cannot access"...what does it say exactly?

 

[Kompete]

Can't be done unless you're idea of "throwing money at it" is way north of R300 000.

Hmmm...little steep, was hoping I could do this for under R10k

Now that sounds more promising...cause that sounds more like a simple FS permission issue. Files will usually lose their encryption if you move them out of the My Docs folder. Explain in detail what you mean by "cannot access"...what does it say exactly?

What I mean with cannot access the files is: I can see the file names, extensions, size etc (i.e. its not hidden); the font colour is green; I can right click the file and open properties, but that is all I can do...I cannot open it (get a message saying "user does not have access privileges or access denied", I also cannot copy or move the files.

Also, you are right that the files should have lost their encryption if you move them out of the My Docs folder (since when I copied files onto flashdisk it worked fine); but somehow it didnt loose its encryption when I copied it onto my Maxtor external disk

 

[werner]

kompete, lets assume they lost their encyption, and life is just confusing, so we may as well try something.

what you describe (besides the green colour) often happens when you reinstall and try get files back, or plug a driv ein from another machine, and it is to do with file permission.

essentially, your user account was kompete/pc1
and now it is kompete/pc2

so it is a different user.

but assuming you are an admin, you can "take ownership" of these files.

do this
http://support.microsoft.com/kb/308421

but note: on xp home only you have to do it in safe mode

it if works, send R10 to the nearest charity, or buy a homeless bloke some bread and milk.

cheers
werner

 

[Kompete]

Thx mate will give it a shot...if it doesnt work, I'm seeing a data recovery specialist tomorrow. Will let you all know.

 

[HavocXphere]

This appears to promise what you need...but I wouldn't hold my breath cause I'm pretty sure that app needs the windows installation to be available to grab the sys key/salt. Worth a shot though.

It all depends on how the EFS key is calculated. If its just based on the user password, then its going to be easy...but this is unlikely unless the HR department does the encryption code for MS. Chances are high that it is somehow salted with the sys key or something like that. That would mean you have to break a 128 bit AES key to get to the files...which is where the R300k estimate comes in (plus minus a zero).

the font colour is green

Will let you all know.

Please do so. I'd be interested in the outcome of this.

Good luck with the recovery specialist....hopefully he knows something I don't.