How to recover encrypted files on an NTFS volume?

  • Thread starter Thread starter DoB
  • Start date Start date
D

DoB

Hi,

Once I encrypted a few files on an NTFS volume on my local w2000 system
and... forgot about it.

In the meantime I changed my hardware and reinstalled my system many times,
but the files were copied each time to a new volume, by disk cloning or by
simple
copying.

The question is... can I decrypt them? I believe I should remember the
username
and password which was used when I encrypted the files, but I did not export
any certificates.

I know about two commercial programs that recover such files, but I am
seeking
a free solution - the files are not worth it.

I found two free and simple solutions to my problem, basing of the fact that
w2000 local administrator is able to decrypt the files.
The solutions do not work, i get the "access denied" error or something
similar.

Is it possible to decrypt my files for free?

DoB.
 
Only if you:
1) Know the password of your account at the time you encrypted the files
2) Still have the *original* profile files with the DPAPI protected key
material *from that time*

Alternatively.
1) You exported the user's efs encryption certificate and private key
2) You exported the original local administrator's recovery certificate and
private key (assuming no domain)
3) You were part of a domain, and the domain admins have the EFS recoveyr
agent's certificate and private key
4) The certificate is not self signed, and issued by an enterprise CA. The
certificate is based on a custom v2 certificate template and was issued by a
CA that implemented key archival

My guess, based on your scenario.
The files are gone.
Brian
 
Only if you:
1) Know the password of your account at the time you encrypted the files
2) Still have the *original* profile files with the DPAPI protected key
material *from that time*
Click to expand...

I think I should have the original profile files backed up on CDs,
I will have to search on my shelves ;-).

What then?

DoB.
 
You must buy one of the 3rd party prodcuts.
If yo know the user's original password and have the original profile
directory,
You can resestablish the certificate and private key through DPAPI
decryption
But you must buy the product
Brian
 
You must buy one of the 3rd party prodcuts.
If yo know the user's original password and have the original profile
directory,
You can resestablish the certificate and private key through DPAPI
decryption
But you must buy the product
Brian
Click to expand...

Well... I am a Win32 api programmer, so if the process is not very
complex and can be described using a few guidelines, I would be eager
to program it myself.

DoB.
 
Best of luck to you
Brian
DoB said:
Well... I am a Win32 api programmer, so if the process is not very
complex and can be described using a few guidelines, I would be eager
to program it myself.

DoB.
Click to expand...
 
Missing STILL IMAGE SERVICE (STISVC)

Brian Komar \(MVP\) said:
Best of luck to you
Brian
"DoB" wrote in message
news:[email protected]...
>> You must buy one of the 3rd party prodcuts.
>> If yo know the user's original password and have the original profile
>> directory,
>> You can resestablish the certificate and private key through DPAPI
>> decryption
>> But you must buy the product
>> Brian
>
> Well... I am a Win32 api programmer, so if the process is not very
> complex and can be described using a few guidelines, I would be eager
> to program it myself.
>
> DoB.
>
Click to expand...
Please Please Help!

I discovered that my canon powershot A460 was unable to communicate with my windows 2000 professional computer. I discovered the STILL IMAGE SERVICE was missing./ not listed in the list of services in my computer management. I am a senior and just learning, cannot afford to go to computer school. I think that I might have deleted some of the required files for Still Image Services. Please help me! How can I find this file and the necessary files to run Still Image Services and how can I reinstall them?

thank you!
god bless you
 
Back
Top