Encrypted File System in XP

Belnahua

I have the job of restoring a HDD from a laptop that had Windows XP Professional on it.

Unfortunately the HDD is very badly corrupted and I've just managed to backup the Docs folder. Couldn't copy it.

Even more unfortunately the user has encrypted their files. Hence why I couldn't copy them!

So now the HDD is dead, and so gone is the EFS recovery key.

I have a bunch of files, encrypted, and no way to recover them! I've trawled the net, and it all seems to come back as the EFS has no workaround.

So does anyone else know of an unofficial way to recover EFS encrypted files, when the key has been lost?

Thanks

superscaper

I think you're stuffed basically if you have neither the key nor the password. You'd have to try and crack the encryption and AFAIK AES is pretty unbreakable unless a very very short/simple password was used. I think you're going to have to tell the user to put this one down to experience. Good opportunity to remind them of backing up and encrypting safely.

I don't think there are any other workarounds, if there are obviously they can't be posted on the forum.

Belnahua

Thanks, I think I just needed to see someone else say before I go back to them!

So a good lesson for all, if you're going to encrypt your XP files, backup the security certificate too!

buglawton

One as to wonder how the User had been accessing the files beforehand. Is it not possible to recover the decryption key so long as you have that User's Windows password?

Belnahua

It's something to do with the window's works! (Not that I have taken much time to study EFS beforehand!). To me, it's a windows annoyance that I'd much rather not having to do with...

As far as I understand it, as long as the user who created the files logs in, they automatically have the key to unlock their files. But they must back up their key should, as in this case, the HDD fails terminally.

I suppose I was lucky to get the files off, but then to find they're encrypted, was like having the gold medal snatched away at the last hurdle!

bookduck

http://www.securitysoftwarezone.com/vista-and-windows-server-2008-encryption-broken-review968-6.html

unofficial, but probably not free

Blacksheep1979

yeah, that's probably a brute forcer and will likely take over a year to recover the data.

Paul_Herring

bookduck wrote: »

but probably not free

£129-£269