EFS Decryption - Lost Certificate

EFS Decryption - Lost Certificate

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
EFS Decryption - Lost Certificate amitava.bhattacharyya 12-28-2007
Posted by Roger Abell [MVP] on December 29, 2007, 9:11 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Since you have now established that the cert used does
match the fingerprint of the files, and since it is not likely
that you intentionally removed the private key, the message
seems to me to be indicating that the account password is
not right (i.e. not reset to what it was the last time something
was decrypted or the last time it was set via change with use
of the old pwd).


The Personal Certificate Manager shows two certificates. efsinfo also
verifies that the currently installed key fingerprint is different
from the key fingerprint in the encrypted files. Since I hadn't
encrypted anything since that unfortunate episode, I exported the
newer certificate and deleted it. Then to be doubly sure, I went to
User Options (as far as I remember, I used the User Options last time
too) and changed my password (to what it already is), logged off, and
logged in. Still no success :(
Windows complains that the private key associated with the older
certificate can't be found. I guess that is the reason why I'm having
no success, although why this should be so is beyond me.
Thanks for the help!

> If you really have changed the password back to what it was,
> in the same way (reset rather than change with providing of
> the old and the new), then perhaps you just have an extra EFS
> certificate that is now in the way.
> If you start / run certmgr.msc and look in the Personal cert
> store how many EFS certificates do you see?
> If more than one then you need to get the newer one out of the way.
> However, having a newer one means that you probably encrypted
> something after you had changed the password (and that would now
> be inaccessible due to the changed password). So, first you need
> to figure what the newer cert controls access to and get that in the
> clear unencrypted (change password back and then decrypt).
> Then for safety export the newer certificate. After that, delete the
> newer and change your password back to what was correct for
> the older certificate.
> In the future, change (not reset) your password so that this does
> not happen.
>
> Roger
>
>
>
> > Hi,
>
> > Sometime back, I had encrypted a folder on my hard drive. In between,
> > I changed my password. Obviously, I was denied access to those files
> > thereafter. So I went back and restored my previous password. Still, I
> > can't access the files. However, when I check Advanced Properties >
> > Encryption Attribute Details, my username is shown in the list of
> > users who have transparent access to the file(s). To add to my woes, I
> > didn't make a backup of the encryption certificate, and XP has no
> > default recovery agent, as I learned later.
> > Is there any way to recover these files? Or are they gone for good?
>
> > TIA!



Posted by Brian Komar on December 29, 2007, 12:37 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Did any of the certificates in the certificate manager have a thumbprint
that matches the thumbprint reported by EFSINFO?
Brian

The Personal Certificate Manager shows two certificates. efsinfo also
verifies that the currently installed key fingerprint is different
from the key fingerprint in the encrypted files. Since I hadn't
encrypted anything since that unfortunate episode, I exported the
newer certificate and deleted it. Then to be doubly sure, I went to
User Options (as far as I remember, I used the User Options last time
too) and changed my password (to what it already is), logged off, and
logged in. Still no success :(
Windows complains that the private key associated with the older
certificate can't be found. I guess that is the reason why I'm having
no success, although why this should be so is beyond me.
Thanks for the help!

> If you really have changed the password back to what it was,
> in the same way (reset rather than change with providing of
> the old and the new), then perhaps you just have an extra EFS
> certificate that is now in the way.
> If you start / run certmgr.msc and look in the Personal cert
> store how many EFS certificates do you see?
> If more than one then you need to get the newer one out of the way.
> However, having a newer one means that you probably encrypted
> something after you had changed the password (and that would now
> be inaccessible due to the changed password). So, first you need
> to figure what the newer cert controls access to and get that in the
> clear unencrypted (change password back and then decrypt).
> Then for safety export the newer certificate. After that, delete the
> newer and change your password back to what was correct for
> the older certificate.
> In the future, change (not reset) your password so that this does
> not happen.
>
> Roger
>
>
>
> > Hi,
>
> > Sometime back, I had encrypted a folder on my hard drive. In between,
> > I changed my password. Obviously, I was denied access to those files
> > thereafter. So I went back and restored my previous password. Still, I
> > can't access the files. However, when I check Advanced Properties >
> > Encryption Attribute Details, my username is shown in the list of
> > users who have transparent access to the file(s). To add to my woes, I
> > didn't make a backup of the encryption certificate, and XP has no
> > default recovery agent, as I learned later.
> > Is there any way to recover these files? Or are they gone for good?
>
> > TIA!


Posted by on December 31, 2007, 8:19 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Sorry for the late reply (year end celebrations :))!

Yes, the older certificate's thumbprint matches the thumbprint in the
encrypted files. When I double click on that certificate, in the
General Tab it says "You have a private key that corresponds to this
certificate." However, if I try to export it, I get the warning that
only the certificate can be exported, since the associated private key
can't be found.

Guess I am screwed :)

On Dec 29 2007, 10:37=A0pm, "Brian Komar"
> Did any of the certificates in the certificate manager have a thumbprint
> that matches the thumbprint reported by EFSINFO?
> Brian
>
>
> The Personal Certificate Manager shows two certificates. efsinfo also
> verifies that the currently installed key fingerprint is different
> from the key fingerprint in the encrypted files. Since I hadn't
> encrypted anything since that unfortunate episode, I exported the
> newer certificate and deleted it. Then to be doubly sure, I went to
> User Options (as far as I remember, I used the User Options last time
> too) and changed my password (to what it already is), logged off, and
> logged in. Still no success :(
> Windows complains that the private key associated with the older
> certificate can't be found. I guess that is the reason why I'm having
> no success, although why this should be so is beyond me.
> Thanks for the help!
>
>
> > If you really have changed the password back to what it was,
> > in the same way (reset rather than change with providing of
> > the old and the new), then perhaps you just have an extra EFS
> > certificate that is now in the way.
> > If you start / run certmgr.msc and look in the Personal cert
> > store how many EFS certificates do you see?
> > If more than one then you need to get the newer one out of the way.
> > However, having a newer one means that you probably encrypted
> > something after you had changed the password (and that would now
> > be inaccessible due to the changed password). So, first you need
> > to figure what the newer cert controls access to and get that in the
> > clear unencrypted (change password back and then decrypt).
> > Then for safety export the newer certificate. After that, delete the
> > newer and change your password back to what was correct for
> > the older certificate.
> > In the future, change (not reset) your password so that this does
> > not happen.
>
> > Roger
>
>

>
> > > Hi,
>
> > > Sometime back, I had encrypted a folder on my hard drive. In between,
> > > I changed my password. Obviously, I was denied access to those files
> > > thereafter. So I went back and restored my previous password. Still, I=

> > > can't access the files. However, when I check Advanced Properties >
> > > Encryption Attribute Details, my username is shown in the list of
> > > users who have transparent access to the file(s). To add to my woes, I=

> > > didn't make a backup of the encryption certificate, and XP has no
> > > default recovery agent, as I learned later.
> > > Is there any way to recover these files? Or are they gone for good?
>
> > > TIA!


Posted by on December 31, 2007, 8:47 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
And yeah, a very happy new year!

On Jan 1, 1:19 am, amitava.bhattachar...@gmail.com wrote:
> Sorry for the late reply (year end celebrations :))!
>
> Yes, the older certificate's thumbprint matches the thumbprint in the
> encrypted files. When I double click on that certificate, in the
> General Tab it says "You have a private key that corresponds to this
> certificate." However, if I try to export it, I get the warning that
> only the certificate can be exported, since the associated private key
> can't be found.
>
> Guess I am screwed :)
>
> On Dec 29 2007, 10:37 pm, "Brian Komar"
>
> > Did any of the certificates in the certificate manager have a thumbprint
> > that matches the thumbprint reported by EFSINFO?
> > Brian
>
>
> > The Personal Certificate Manager shows two certificates. efsinfo also
> > verifies that the currently installed key fingerprint is different
> > from the key fingerprint in the encrypted files. Since I hadn't
> > encrypted anything since that unfortunate episode, I exported the
> > newer certificate and deleted it. Then to be doubly sure, I went to
> > User Options (as far as I remember, I used the User Options last time
> > too) and changed my password (to what it already is), logged off, and
> > logged in. Still no success :(
> > Windows complains that the private key associated with the older
> > certificate can't be found. I guess that is the reason why I'm having
> > no success, although why this should be so is beyond me.
> > Thanks for the help!
>
>
> > > If you really have changed the password back to what it was,
> > > in the same way (reset rather than change with providing of
> > > the old and the new), then perhaps you just have an extra EFS
> > > certificate that is now in the way.
> > > If you start / run certmgr.msc and look in the Personal cert
> > > store how many EFS certificates do you see?
> > > If more than one then you need to get the newer one out of the way.
> > > However, having a newer one means that you probably encrypted
> > > something after you had changed the password (and that would now
> > > be inaccessible due to the changed password). So, first you need
> > > to figure what the newer cert controls access to and get that in the
> > > clear unencrypted (change password back and then decrypt).
> > > Then for safety export the newer certificate. After that, delete the
> > > newer and change your password back to what was correct for
> > > the older certificate.
> > > In the future, change (not reset) your password so that this does
> > > not happen.
>
> > > Roger
>
>
>
> > > > Hi,
>
> > > > Sometime back, I had encrypted a folder on my hard drive. In between,
> > > > I changed my password. Obviously, I was denied access to those files
> > > > thereafter. So I went back and restored my previous password. Still, I
> > > > can't access the files. However, when I check Advanced Properties >
> > > > Encryption Attribute Details, my username is shown in the list of
> > > > users who have transparent access to the file(s). To add to my woes, I
> > > > didn't make a backup of the encryption certificate, and XP has no
> > > > default recovery agent, as I learned later.
> > > > Is there any way to recover these files? Or are they gone for good?
>
> > > > TIA!


Similar ThreadsPosted
Windows XP certificate lost? February 23, 2007, 12:11 pm
RE: Data decryption EFS June 17, 2005, 7:42 am
File Decryption August 11, 2005, 12:13 am
Data decryption EFS June 16, 2005, 4:39 am
C# and SMIME Decryption July 13, 2006, 7:03 pm
Smart Card Login + Certificate Login to AD -> Lost smart card December 15, 2005, 10:03 pm
Smart Card Login + Certificate Login to AD -> Lost smart card December 15, 2005, 10:41 pm
lost my CD March 16, 2008, 1:30 pm
hotmail - lost password June 22, 2005, 7:24 am
Lost security tools July 22, 2005, 1:17 am

The site map in XML format XML site map

Contact Us | Privacy Policy