| Author |
Message |
Kevin
Guest
|
 Posted:
Tue Nov 01, 2005 1:28 am Post subject:
Encrypted Files from a formatted drive |
|
|
Files were encrypted on a disk from a computer that the drive has since been
formatted and no backups exist anymore. The files were created and stored on
an external drive. With the drive connected to a different machine, of
course, they cannot be opened. I realize that any account on this system is
not a recovery agent nor the account that created encrypted the files. But
I'm guessing a way exists to recover the files, just hopeing you guys/gals
might have an idea of how to do it?
Hopefully I'm not S.O.L on this one
Thanks |
|
| Back to top |
|
 |
Steven L Umbach
Guest
|
| Posted:
Tue Nov 01, 2005 1:28 am Post subject:
Re: Encrypted Files from a formatted drive |
|
|
Without a RA the only way would be if the user that created the EFS files
had exported their EFS certificate/private key to a password protected .pfx
file for safekeeping for and event like this. Also if there is a copy of the
user's profile somewhere in a backup there also may be a way to extract the
user's private key from it but my guess is there is not from your
description of the scenario. There is no backdoor way to access EFS files.
If there are no user or RA private key available then the files are forever
gone. --- Steve
http://support.microsoft.com/default.aspx?scid=kb;EN-US;223316 --- EFS info
and best practices.
"Kevin" <Kevin@discussions.microsoft.com> wrote in message
news:62D513C9-B06D-4BCF-BDC7-7A6E5828952E@microsoft.com...
| Quote: | Files were encrypted on a disk from a computer that the drive has since
been
formatted and no backups exist anymore. The files were created and stored
on
an external drive. With the drive connected to a different machine, of
course, they cannot be opened. I realize that any account on this system
is
not a recovery agent nor the account that created encrypted the files.
But
I'm guessing a way exists to recover the files, just hopeing you guys/gals
might have an idea of how to do it?
Hopefully I'm not S.O.L on this one
Thanks |
|
|
| Back to top |
|
|
Jupiter Jones [MVP]
Guest
|
| Posted:
Tue Nov 01, 2005 9:27 am Post subject:
Re: Encrypted Files from a formatted drive |
|
|
Without the necessary files, your data is effectively gone.
EFS is secure and there is no back door which would render EFS weak.
See the links at the bottom of this page to help prevent this in the future:
http://www3.telus.net/dandemar/encrypt.htm
--
Jupiter Jones [MVP]
http://www3.telus.net/dandemar
http://www.dts-l.org
"Kevin" <Kevin@discussions.microsoft.com> wrote in message
news:62D513C9-B06D-4BCF-BDC7-7A6E5828952E@microsoft.com...
| Quote: | Files were encrypted on a disk from a computer that the drive has since
been
formatted and no backups exist anymore. The files were created and stored
on
an external drive. With the drive connected to a different machine, of
course, they cannot be opened. I realize that any account on this system
is
not a recovery agent nor the account that created encrypted the files.
But
I'm guessing a way exists to recover the files, just hopeing you guys/gals
might have an idea of how to do it?
Hopefully I'm not S.O.L on this one
Thanks |
|
|
| Back to top |
|
|
Segovia
Guest
|
| Posted:
Tue Nov 01, 2005 9:27 am Post subject:
Re: Encrypted Files from a formatted drive |
|
|
On Mon, 31 Oct 2005 17:09:01 -0800, Kevin wrote:
| Quote: | I realize that any account on this system is
not a recovery agent nor the account that created encrypted the files.
|
Without the key you are totally hosed. You might as well accept that the
data is gone...
However you did say that the drive containing the key was formatted. That
in itself does not destroy the data. If you reinstalled the OS after that,
and all the data files, then you might be out of luck since it's likely
that the clusters containing the key have been overwritten by now.
--
Segovia |
|
| Back to top |
|
|
Shenan Stanley
Guest
|
| Posted:
Tue Nov 01, 2005 9:27 am Post subject:
Re: Encrypted Files from a formatted drive |
|
|
Kevin wrote:
| Quote: | Files were encrypted on a disk from a computer that the drive has
since been formatted and no backups exist anymore. The files were
created and stored on an external drive. With the drive connected to
a different machine, of course, they cannot be opened. I realize
that any account on this system is not a recovery agent nor the
account that created encrypted the files. But I'm guessing a way
exists to recover the files, just hopeing you guys/gals might have an
idea of how to do it?
Hopefully I'm not S.O.L on this one
|
You might try third party products - but my initial guess would be S.O.L.
For example...
http://www.elcomsoft.com/aefsdr.html
--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html |
|
| Back to top |
|
|
|
|
|
|
FAQ
Memberlist
Register
Profile
Log in to check your private messages
Log in