Unable to access Encrypting File System despite knowing username/password

[jsausten]

This morning my WinXP SP2 laptop suddenly refused to boot and wouldn't
get past the first few lines of the bios. Its on its way back to the
supplier and I have pulled the hard drive and put it into a external
USB housing in order to recover files, including several directories
that were encrypted using Windows' Encrypting File System. I have
logged onto my desktop using the exact same user name/password
combination as I was using on the laptop and I can browse the entire
hard drive, but I cannot open, copy or move any of the encrypted files.

Googling the problem, it appears that I need the Encryption Certificate
Key for the laptop in order to be able to decrypt the files.

I have followed KB308421 and attempted to take ownership of the
encrypted directories. I have also tried using the cipher command line
tool, but this also fails.

Are there any other techniques I can use to access these files?

So my questions are:
1. The laptop hard drive is undamaged. Can I access the Encryption
Certificate Key?
2. One of the encrypted directories was also shared and I used to
regularly access that directory from the desktop and I never had a
problem. How on earth did this work?
3. Why isn't the importance of backing up your Certificate displayed
in big bold flashing print when you attempt to encrypt a directory? I
know the username and password used to encrypt the files; why would I
even think that anything else was need to access the files?
4. If I can't recover the files, why am I even permitted to browse the
encrypted sub-directories? Surely even knowing file names and directory
structure is a security problem.

Thanks,

Stephen

 

[abc123]

On 13 Dec 2004 06:06:30 -0800, (e-mail address removed) wrote:

Did you try this while you were logged on as the local administrator?

 

[Guest]

Does your laptop hard drive have an OS on it and can you boot into it (by
editing the desktop's boot.ini)? If you can, log on as the same user/same
password as before and you should be able to recover those files. (Back up
your EFS certificate/keys with "cipher /x" while you're logged in.) Another
alternative is the reccerts.exe process, but you'll need to contact MS
Product Support for that.

Thanks.
Pat

 

[Guest]

I have encrypted file in Windows 2000. I had to reinstall My Windows.
Reformatted the drive NTFS and I install Windows XP Pro. Now I cannot access
these files (encrypted file) in My Drive, which are stored in a separate
partition. How can I open Files Encrypted in My system.
Best Regards
Fatemeh Rezaei

 

[Galen]

In fatemeh <[email protected]> had this to say:

My reply is at the bottom of your sent message:

I have encrypted file in Windows 2000. I had to reinstall My Windows.
Reformatted the drive NTFS and I install Windows XP Pro. Now I
cannot access these files (encrypted file) in My Drive, which are
stored in a separate partition. How can I open Files Encrypted in My
system.
Best Regards
Fatemeh Rezaei

Did you export the key? If not then you're really in a bit of trouble as
it's not something that's easily recovered. If you exported and saved the
key and have it you can import it and access the files. If not then you're
probably not going to get them back.

Galen

 

[Jupiter Jones [MVP]]

Do you have access to the original keys or profile?
Recreated after the fact such as after a format is no good.
Your data is most likely gone for good unless you have the originals.
See the links near the bottom of this page to help prevent this from
happening again:
http://www3.telus.net/dandemar/encrypt.htm

 

[Guest]

Hi Galen
Thanks alot for your Email but I do not underestand your mean. waht do you
mean about key? what key I must export. can you describe your mean much more.
best regards
fatemeh

 

[Guest]

Thank you for your response. I did your orders. I set up Advanced EFS Data
Recovery V3.0 software in my system. But My Encrypted files didn't open.
Can You help me more? My Email is (e-mail address removed)