Help accessing encrypted files Windows 7

Status
Not open for further replies.

rwgwiccan

Distinguished
Feb 15, 2012
9
0
18,510
Hey all I encrypted some files on my E drive to secure them. About two months latter my C drive crashed and I had to reinstall windows 7. Now that I have done this I cannot access any of those previously encrypted files. I have the password that was used to encrypt them, but I am unable to access any part of the file. I have taken ownership of all of the files, but even after doing that and making all of the files visible I am unable to remove the encryption and unable to open them still. Any help would be appreciated.
 
Solution
Hmm. I've been looking for ways to recover from EFS - I'm guessing that you used the Encrypted Filesystem that comes with Windows: Right-click, properties, advanced, encrypt. Unfortunately, my best interpretation of my reading is that the key is in some way kept in Windows with your user data, rather than being a password or passphrase. Some of the articles are here:
http://support.microsoft.com/kb/308993
http://support.microsoft.com/kb/223316

The second one describes exporting keys, but if your system disk crashed it is too late to do that. Was it the system drive that crashed? If you have a backup of the system drive taken after the folder was encrypted, you could try restoring it to a fresh drive, booting it, and then...
rwgwiccan

With no offense meant to you, these kinds of questions are usually against forum policy. Some small number of posters are actually trying to access devices or files of which they are not the owners.

That said, two questions: What application was used to encrypt them? In most cases, if you reinstall the same version and have the password and, if relevant, the key files, you can decode the file. I personally use PGP and have found the encrypted files to be compatible across systems.

Two other thoughts: Is it possible that the system crash corrupted the encrypted files, which would render them useless? Do you have backups, either encrypted or unencrypted.
 

rwgwiccan

Distinguished
Feb 15, 2012
9
0
18,510


I ensure you these are my files, and I am not trying to illegally access anything that does not belong to me. The only reason I encrypted the files was due to the graphic nature of some of the content and I did not want my child to have access to them.

That said I used the encryption services that came with windows. The files are on a different drive than the one that crashed and every single other file on that drive is fine. None of the files in question were in use when the computer crashed. I have run a few different types of file scanners and it appears that the files are completely fine and intact, I just cannot access them due to the encryption.
 
Hmm. I've been looking for ways to recover from EFS - I'm guessing that you used the Encrypted Filesystem that comes with Windows: Right-click, properties, advanced, encrypt. Unfortunately, my best interpretation of my reading is that the key is in some way kept in Windows with your user data, rather than being a password or passphrase. Some of the articles are here:
http://support.microsoft.com/kb/308993
http://support.microsoft.com/kb/223316

The second one describes exporting keys, but if your system disk crashed it is too late to do that. Was it the system drive that crashed? If you have a backup of the system drive taken after the folder was encrypted, you could try restoring it to a fresh drive, booting it, and then exporting the private key / certificate / whatever.

Unless you can get an image of your old system running, I don't see any way that this can be done other than brute-force cracking. Perhaps Microsoft Support would know more, but I doubt that they would reveal an answer if they had one. Sorry.
 
Solution
Encryption used by Windows is tied to the user, if you forcibly change a user password from another account you will see a warning message come up stating that some types of encryption and rights management may not work if you do this.

Even creating a new user with the same name won't work, the security ID is created for each account. New account with same name is a totally different account to Windows for security purposes.

Unfortunately most people don't backup their keys BEFORE issues happen, which is when you need to in order to recover.
 

ankur9005

Honorable
Sep 6, 2013
4
0
10,510


Sir i want the same solution too as my windows crashed and need to format it after that i was unable to dycrypt the files encrypted by EFS on the same machine. please help me that are too important. Thanks in advance looking for a positive response from you.
 
Status
Not open for further replies.