EFS Decryption - Lost Certificate

EFS Decryption - Lost Certificate
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
EFS Decryption - Lost Certificate amitava.bhattacharyya 12-28-2007
Posted by on December 28, 2007, 9:00 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi,

Sometime back, I had encrypted a folder on my hard drive. In between,
I changed my password. Obviously, I was denied access to those files
thereafter. So I went back and restored my previous password. Still, I
can't access the files. However, when I check Advanced Properties >
Encryption Attribute Details, my username is shown in the list of
users who have transparent access to the file(s). To add to my woes, I
didn't make a backup of the encryption certificate, and XP has no
default recovery agent, as I learned later.
Is there any way to recover these files? Or are they gone for good?

TIA!

Posted by Malke on December 28, 2007, 9:55 am
If you were  Registered and logged in, you could reply and use other advanced thread options
amitava.bhattacharyya@gmail.com wrote:
> Hi,
>
> Sometime back, I had encrypted a folder on my hard drive. In between,
> I changed my password. Obviously, I was denied access to those files
> thereafter. So I went back and restored my previous password. Still, I
> can't access the files. However, when I check Advanced Properties >
> Encryption Attribute Details, my username is shown in the list of
> users who have transparent access to the file(s). To add to my woes, I
> didn't make a backup of the encryption certificate, and XP has no
> default recovery agent, as I learned later.
> Is there any way to recover these files? Or are they gone for good?

You can check with Elcomsoft to see if their program can recover your
encrypted files:

http://www.elcomsoft.com/aefsdr.html

If it can, pay for the program and chalk this one up to a relatively
inexpensive learning experience about how important it is to Back Stuff
Up. If the Elcomsoft program can't recover your files, then you are SOL.


Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

Posted by on December 28, 2007, 10:22 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi!

Thanks for the quick response. I downloaded the trial version and
tried, but it stops ~56% into scanning C: drive for keys. Without
that, and even with my password (as I have come to expect by now :)),
it shows the files as not decrypt-able.
Guess I have to file this as a learning experience. Thankfully I had a
few of the files on a pen drive.

Thanks!

> amitava.bhattachar...@gmail.com wrote:
> > Hi,
>
> > Sometime back, I had encrypted a folder on my hard drive. In between,
> > I changed my password. Obviously, I was denied access to those files
> > thereafter. So I went back and restored my previous password. Still, I
> > can't access the files. However, when I check Advanced Properties >
> > Encryption Attribute Details, my username is shown in the list of
> > users who have transparent access to the file(s). To add to my woes, I
> > didn't make a backup of the encryption certificate, and XP has no
> > default recovery agent, as I learned later.
> > Is there any way to recover these files? Or are they gone for good?
>
> You can check with Elcomsoft to see if their program can recover your
> encrypted files:
>
> http://www.elcomsoft.com/aefsdr.html
>
> If it can, pay for the program and chalk this one up to a relatively
> inexpensive learning experience about how important it is to Back Stuff
> Up. If the Elcomsoft program can't recover your files, then you are SOL.
>
> Malke
> --
> Elephant Boy Computerswww.elephantboycomputers.com
> "Don't Panic!"
> MS-MVP Windows - Shell/User


Posted by Roger Abell [MVP] on December 28, 2007, 10:42 am
If you were  Registered and logged in, you could reply and use other advanced thread options
If you really have changed the password back to what it was,
in the same way (reset rather than change with providing of
the old and the new), then perhaps you just have an extra EFS
certificate that is now in the way.
If you start / run certmgr.msc and look in the Personal cert
store how many EFS certificates do you see?
If more than one then you need to get the newer one out of the way.
However, having a newer one means that you probably encrypted
something after you had changed the password (and that would now
be inaccessible due to the changed password). So, first you need
to figure what the newer cert controls access to and get that in the
clear unencrypted (change password back and then decrypt).
Then for safety export the newer certificate. After that, delete the
newer and change your password back to what was correct for
the older certificate.
In the future, change (not reset) your password so that this does
not happen.

Roger

> Hi,
>
> Sometime back, I had encrypted a folder on my hard drive. In between,
> I changed my password. Obviously, I was denied access to those files
> thereafter. So I went back and restored my previous password. Still, I
> can't access the files. However, when I check Advanced Properties >
> Encryption Attribute Details, my username is shown in the list of
> users who have transparent access to the file(s). To add to my woes, I
> didn't make a backup of the encryption certificate, and XP has no
> default recovery agent, as I learned later.
> Is there any way to recover these files? Or are they gone for good?
>
> TIA!



Posted by on December 29, 2007, 3:10 am
If you were  Registered and logged in, you could reply and use other advanced thread options
The Personal Certificate Manager shows two certificates. efsinfo also
verifies that the currently installed key fingerprint is different
from the key fingerprint in the encrypted files. Since I hadn't
encrypted anything since that unfortunate episode, I exported the
newer certificate and deleted it. Then to be doubly sure, I went to
User Options (as far as I remember, I used the User Options last time
too) and changed my password (to what it already is), logged off, and
logged in. Still no success :(
Windows complains that the private key associated with the older
certificate can't be found. I guess that is the reason why I'm having
no success, although why this should be so is beyond me.
Thanks for the help!

> If you really have changed the password back to what it was,
> in the same way (reset rather than change with providing of
> the old =A0and the new), then perhaps you just have an extra EFS
> certificate that is now in the way.
> If you start / run =A0certmgr.msc =A0and look in the Personal cert
> store how many EFS certificates do you see?
> If more than one then you need to get the newer one out of the way.
> However, having a newer one means that you probably encrypted
> something after you had changed the password (and that would now
> be inaccessible due to the changed password). =A0So, first you need
> to figure what the newer cert controls access to and get that in the
> clear unencrypted (change password back and then decrypt).
> Then for safety export the newer certificate. =A0After that, delete the
> newer and change your password back to what was correct for
> the older certificate.
> In the future, change (not reset) your password so that this does
> not happen.
>
> Roger
>
>
>
> > Hi,
>
> > Sometime back, I had encrypted a folder on my hard drive. In between,
> > I changed my password. Obviously, I was denied access to those files
> > thereafter. So I went back and restored my previous password. Still, I
> > can't access the files. However, when I check Advanced Properties >
> > Encryption Attribute Details, my username is shown in the list of
> > users who have transparent access to the file(s). To add to my woes, I
> > didn't make a backup of the encryption certificate, and XP has no
> > default recovery agent, as I learned later.
> > Is there any way to recover these files? Or are they gone for good?
>
> > TIA!


Similar ThreadsPosted
Windows XP certificate lost? February 23, 2007, 12:11 pm
RE: Data decryption EFS June 17, 2005, 7:42 am
File Decryption August 11, 2005, 12:13 am
Data decryption EFS June 16, 2005, 4:39 am
C# and SMIME Decryption July 13, 2006, 7:03 pm
Smart Card Login + Certificate Login to AD -> Lost smart card December 15, 2005, 10:03 pm
Smart Card Login + Certificate Login to AD -> Lost smart card December 15, 2005, 10:41 pm
lost my CD March 16, 2008, 1:30 pm
hotmail - lost password June 22, 2005, 7:24 am
Lost security tools July 22, 2005, 1:17 am

The site map in XML format XML site map

Contact Us | Privacy Policy