Decrypting Files

If you failed to make copies of your Personal Encryption Certificate,
and associated Private Key (and no recovery agent certificates exist)
when your original Windows XP installation was operational, you
won't be able to open or use your encrypted files.
No back door exists, nor is there any practical way to open those files.
(If there were, it wouldn't be very good encryption.)

HOW TO: Remove File Encryption in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;308993

Without a backup of the original Encryption Certificate Key, encrypted files
are unrecoverable as they will stay encrypted forever. There is no recovery
method since the encryption security algorithm is now completely different
with a reinstall of Windows XP.

See if the following articles help in any way:

HOW TO: Take Ownership of a File or Folder in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308421

Best Practices for the Encrypting File System
http://support.microsoft.com/default.aspx?scid=kb;en-us;223316

Encrypting File System in Windows XP
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/cryptfs.mspx

EFS Files Appear Corrupted When You Open Them
http://support.microsoft.com/default.aspx?scid=kb;en-us;329741

--
Carey Frisch
Microsoft MVP
Windows - Shell/User
Microsoft Community Newsgroups
news://msnews.microsoft.com/

-------------------------------------------------------------------------------------------

"demondax" wrote:

| Hi,
| I have got a very BIG PROBLEM.I have recently done a fresh Windows
| XP SP2 opeating system installation in my Computer,previoUsly I had Windows
| XP Proesional (Non SP2) installed.After this new installation I found that
| all the prviously encrypted files(pdf,doc,html etc) are not opening , now evn
| I can not decrypt them as well.Here I like to mention that during the
| operatin system installation I had formatted the C:/ Drive but those encryptd
| files are in a different drive/partition.Is there anyway to rcover those
| files?please help me out.
 >> Stay informed about: Decrypting Files 

Well I hate to tell you this but unless you had backed up for EFS
certificate/private key to a password protected .pfx file for safe keeping
on external media then you are out of luck. Your EFS certificate private key
was stored in your user profile on the drive that you formatted. Technically
it may be possible to recover it by a specialist skilled at recovering
hidden data from a hard drive IF the sectors that held the original user
profile were not overwritten by the new install. That may cost a lot of
money with no guarantee. The EFS private key is needed because it decrypts
the FEK [file encryption key] used to encrypt the data. In XP EFS encryption
used is very strong and there is no way to brute force crack the encryption
short of leasing the National Security Agency computers for at least a few
years. Regardless of what anyone else says there is no software that you
can download to access those files without your user EFS private key [or
Recovery Agent if used which is not required in XP Pro] --- Steve

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q223316 --- EFS
best practices and general info

"demondax@rediffmail.com"
<demondax.TakeThisOut@rediffmail.com@discussions.microsoft.com> wrote in message
news:7037615A-7409-49FA-9863-82E41192C606@microsoft.com...
> Hi,
> I have got a very BIG PROBLEM.I have recently done a fresh
> Windows
> XP SP2 opeating system installation in my Computer,previoUsly I had
> Windows
> XP Proesional (Non SP2) installed.After this new installation I found that
> all the prviously encrypted files(pdf,doc,html etc) are not opening , now
> evn
> I can not decrypt them as well.Here I like to mention that during the
> operatin system installation I had formatted the C:/ Drive but those
> encryptd
> files are in a different drive/partition.Is there anyway to rcover those
> files?please help me out.
 >> Stay informed about: Decrypting Files 

In the last post, Steve had said:

"Technically it may be possible to recover it by a specialist skilled at recovering hidden data from a hard drive IF the sectors that held the original user profile were not overwritten by the new install."

Well, I had a hard drive crash at work, and did have the drive professionally recovered. I have a copy of the recovered image which I have been using to restore things which weren't backed-up (most was). In my effort, I am occaisonally coming across a file that has the Windows Encryption attribute set. (I have no idea why I've only found a few files - most have been C++ source or header files that I created, and other files in the same folder, from the same project are not encrypted). For all the reasons listed previous I can't un-encrypt them. Now that I've found some of these files, I even went back to some of my pre-crash backups, and lo and behold, those files were encrypted. The old drive had Win2k on it, IT set up the replacement with XP.

Since I do have the recovered data from the old drive, on my backup drive, I'm assuming that the encrption information from the old configuration is deeply buried in there somewhere. Is there some way to extract for the old drive data what I need to decrypt the files???

This seems to be what Steve was implying. So, I have the data (I hope that might have been properly recovered), how do I 1) Find it, and 2) Apply it within the context of my "new" configuration to allow decryption of the files????

Thanks in advance to anyone who can help!

Mike
 >> Stay informed about: Decrypting Files