another EFS recovery question

[Guest]

al

i have an external hard drive on which i back up files. one folder is encrypted. unfortunately, i did not export the certificate before my computer crashed. now i have another computer, and it can access the external drive, but of course the files in the encrypted folder are not accessible. i *did*, however, export the 1st computer's registry before it crashed

question - can i use any of the 1st computer's registry keys to recover the certificate

hope this is clear, thanks in advance...

 

[Steven L Umbach]

The EFS private key used to decrypt are stored in the users profile, so unless you
have a copy of the users or recovery agent's [probably built in administrator]
profile at a time after those files were encrypted, you are out of luck. --- Steve

all

i have an external hard drive on which i back up files. one folder is encrypted.

unfortunately, i did not export the certificate before my computer crashed. now i
have another computer, and it can access the external drive, but of course the files
in the encrypted folder are not accessible. i *did*, however, export the 1st
computer's registry before it crashed.

 

[Guest]

Steve

thanks...is there nothing i can use from the exported registry? are there no keys, which when imported, that can recover the certificate? the 1st computer's hard drive blew up, so i was not able to recover the user profile..

any hope

Ken

----- Steven L Umbach wrote: ----

The EFS private key used to decrypt are stored in the users profile, so unless yo
have a copy of the users or recovery agent's [probably built in administrator
profile at a time after those files were encrypted, you are out of luck. --- Stev

al

unfortunately, i did not export the certificate before my computer crashed. now
have another computer, and it can access the external drive, but of course the file
in the encrypted folder are not accessible. i *did*, however, export the 1s
computer's registry before it crashed

 

[Steven L Umbach]

From what I know, you are out of luck. You can experiment with importing the registry
if you like - you don't have a lot to loose and then try the trial recovery software
from Elcomsoft to see if the key is found. --- Steve

http://www.elcomsoft.com/aefsdr.html
http://www.softpile.com/Utilities/Encryption/Review_16778_index.html

Steven

thanks...is there nothing i can use from the exported registry? are there no keys,

which when imported, that can recover the certificate? the 1st computer's hard drive
blew up, so i was not able to recover the user profile...

any hope?

KenN

----- Steven L Umbach wrote: -----

The EFS private key used to decrypt are stored in the users profile, so unless you
have a copy of the users or recovery agent's [probably built in administrator]
profile at a time after those files were encrypted, you are out of luck. --- Steve encrypted.
unfortunately, i did not export the certificate before my computer crashed. now i
have another computer, and it can access the external drive, but of course the files
in the encrypted folder are not accessible. i *did*, however, export the 1st
computer's registry before it crashed.

 

[Drew Cooper [MSFT]]

Private keys aren't stored in the registry in Win2k+. You may be able to
find the certificate blob in a couple of places, but without the private
keys, it won't do any good.
--
Drew Cooper [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

From what I know, you are out of luck. You can experiment with importing the registry
if you like - you don't have a lot to loose and then try the trial recovery software
from Elcomsoft to see if the key is found. --- Steve

http://www.elcomsoft.com/aefsdr.html
http://www.softpile.com/Utilities/Encryption/Review_16778_index.html

Steven

thanks...is there nothing i can use from the exported registry? are

there no keys,
which when imported, that can recover the certificate? the 1st computer's hard drive
blew up, so i was not able to recover the user profile...

any hope?

KenN

----- Steven L Umbach wrote: -----

The EFS private key used to decrypt are stored in the users

profile, so unless
you

have a copy of the users or recovery agent's [probably built in administrator]
profile at a time after those files were encrypted, you are out of

luck. ---
Steve folder is
encrypted.

unfortunately, i did not export the certificate before my computer

crashed.
now i

have another computer, and it can access the external drive, but of

course the
files

in the encrypted folder are not accessible. i *did*, however, export the 1st
computer's registry before it crashed. recover the
certificate?