Encrypted files - EFS

[Helevitia]

Well, I am a dumbass.

I encrypted tons of movies, music, pictures, and misc. stuff. All on my 250GB firewire drive.

I then formatted my priary drive and re-installed winxp.

I have just learned the hardway that ALL of my files are un-encyptable

I thought I'd check with you all before I curl up into a fetal position and cry myself to sleep.

I tried this software and it told me I was ****ed

All Windows knowledge base says I am ****ed. Any last ditch ideas before I lose all of this data (100GB+ worth).

*Goes to ready noose*

Thanks in advance

Dave

[Helevitia]

BTW - What is the lesson? IF you MUST encrypt your files, amke sure you backup your certificates and stuff so you can transfer them to the newly formatted drive.

[Jon P. Inghram]

Ouch, that sucks.

From what I've seen the only real function of EFS is to lose data...

[Jon P. Inghram]

Here's a site that has some useful info:

http://www.beginningtoseethelight.org/efsrecovery/

[Paddy]

have you tried unformating, jsut to get your keys back?
Also, I ahve some data recovery software which may not work on your encrypted drive, but should be able to see the data on the nuked one- providing of course that you havn't overwritten everything...

[ayoub_ibrahim]

sorry to hear of your plight but your data is gone!
it's probably too late now but have a read here for the future.

[KeiFront]

sad to hear that, I hope you can recover your stuff.

I once used efs, but I stopped using it, I encountered too many drawbacks when working with it.

[agallag]

Sounds like EFS worked exactly as it was supposed to. If you don't have a backup of your certificates, then the data is truely gone. Unless of course you want to start up a distributed computing project and run it for 6 months to try to crack the key.

The lesson is, always backup your certs!!

[Jon P. Inghram]

Back up your what? In case you've never used XP's encryption, here's how it works:

Right click on icon of object to be encrypted->properties->advanced->check "Encrypt contents to secure data"->Ok->Ok

There, now you have an apparently magicly encrypted file, no warnings about backing up certifications, nothing about the potential to lose data, just a check-mark and green icon label text.

I guess being "user friendly" means not telling the user about ABSOLUTELY CRITICAL INFORMATION.

[Jammrock]

Log on as Adminitrator (not an administrator, the Administrator). Move the folder to C:\ (if it won't let you, try the command below on the firewire drive). Open command prompt (Start -> Run, Open: CMD -> OK). Try some of these commands:

Run this command first:

CIPHER /n /u

ANd then one or both of these:

CIPHER /d /s:folder /a /i /f

CIPHER /d /a /i /f path/file

What this should do is force all encrpyted files to use the computers current encryption key:

/u
Updates the user's file encryption key or recovery agent's key to the current ones in all of the encrypted files on local drives (that is, if the keys have been changed). This option only works with /n.
/n
Prevents keys from being updated. Use this option to find all of the encrypted files on the local drives. This option only works with /u.

And the second command should force a decryption of the files. Should being the operative word. If you're having troubles logging in as Administrator (or whatever you renamed it to), reboot, press F8 after POST to enter the boot screen, enter Safe Mode. That will get you into Administrator.

Let me know how it works.

Jammrock

[Helevitia]

Thanks for the help and suggestions everyone.

Jammrock, that didn't work

Every single file is still encrypted.

[Kurt]

@Jammrock: it can't work since the keys are "based" on the recovery agent key. When you format, everything goes. The "old" keys are thus not based on the "new" recovery agent key, so you cant't get anything back.

You could try a recovery program, get the files back and hopefully the right key will be amongst them -or you have alot of time to try and crack it. Otherwise, swallow hard.

[agallag]

Jammrock, if that worked, it would kind of defeat the purpose of encryption, don't you think?

Those commands will only work if you're logged in to the computer as the original user that encrypted the files, or as the recovery agent. Once you format, all bets are off.

If the section of the drive that held the local SAM database for the old installation hasn't been overwritten, it may be possible to pull the original encyrption keys out of there, but you'd need specialized tools and a lot of luck for that to work.

[schmosef]

Man, I feel for you!

[RC Agent]

Was there a solution to this??