forums
new posts
donate
UER Store
events
location db
db map
search
members
faq
terms of service
privacy policy
register
login




UER Forum > Private Boards Index > Tech Talk > Decrypying EFS (Viewed 2027 times)
fedge 


Location: Gaud Corners, Ontario, Canada
Gender: Male
Total Likes: 11 likes


you blight up my life™®

 |  |  | Fedge Explorations
Decrypying EFS
< on 5/3/2008 9:08 PM >
Reply with Quote
Posted on Forum: UER Forum
I backed up data onto a removeable drive then reformatted my computer. Now, trying to get the files back onto my new install, I realized some files and folders were encrypted with EFS (resulting in green file names). I've resigned myself to forever losing this data. But does anyone have a solution? Apart from brute force attacking it?



[last edit 5/3/2008 9:09 PM by fedge - edited 1 times]

18-odd Years Of UER-ing!
z0th 


Location: /dev/urandom
Gender: Male
Total Likes: 86 likes


On the bleeding edge of cocking things up.

 |  |  | shadowfactory.ca
Re: Decrypying EFS
< Reply # 1 on 5/3/2008 10:13 PM >
Reply with Quote
Posted on Forum: UER Forum
do you know the previous login password for your old install and/or did you back up your key pairs?

edit: it looks like EFS has been fairly resistant to brute forcing. were you using XP or 2k? this could make a difference, as they used different crypt algos, and windows 2k gave the admin a 'master key' (data recovery agent) to any EFS on the system. XP does not have this option.

some recovery software here:
http://www.forensi...rypted_File_System

LabMice has a good collection of articles on EFS in general, with a section dedicated to recovery:
http://labmice.tec...0/FileMgmt/EFS.htm

if the info is of serious value, you may even want to contact a data recovery group about it.



[last edit 5/3/2008 10:32 PM by z0th - edited 1 times]

gallery | deviantart | flickr
fedge 


Location: Gaud Corners, Ontario, Canada
Gender: Male
Total Likes: 11 likes


you blight up my life™®

 |  |  | Fedge Explorations
Re: Decrypying EFS
< Reply # 2 on 5/3/2008 10:17 PM >
Reply with Quote
Posted on Forum: UER Forum
Unfortunately, no. It was an afterthought -- after I already formatted the computer. Data gone forever, right?




18-odd Years Of UER-ing!
z0th 


Location: /dev/urandom
Gender: Male
Total Likes: 86 likes


On the bleeding edge of cocking things up.

 |  |  | shadowfactory.ca
Re: Decrypying EFS
< Reply # 3 on 5/3/2008 10:35 PM >
Reply with Quote
Posted on Forum: UER Forum
if you dont have anything.... things dont look good. check out the above links anyways, you never know what you might stumble across.



[last edit 5/3/2008 10:43 PM by z0th - edited 1 times]

gallery | deviantart | flickr
blackhawk 

This member has been banned. See the banlist for more information.


Location: Mission Control
Total Likes: 3996 likes


UER newbie

 |  |  | 
Re: Decrypying EFS
< Reply # 4 on 5/7/2008 5:17 PM >
Reply with Quote
Posted on Forum: UER Forum
Sorry to hear of your problems. If the data is really valuable it probably could be recovered, but probably not cheaply.

In the future set up separate OS and data HDs to help avoid this in the future. I've lost some data too... shit happens.




Just when I thought I was out... they pulled me back in.
Beryl 

Not as fluffy as Av!


Location: Germany
Gender: Male
Total Likes: 1 like


Uncle Beryl

 |  | 
Re: Decrypying EFS
< Reply # 5 on 6/8/2008 5:51 PM >
Reply with Quote
Posted on Forum: UER Forum
I actually just ordered a copy of Advanced EFS Recovery that should arrive in the next few days; Do you still need recovery? If so, what OS were you using?



[last edit 6/8/2008 5:51 PM by Beryl - edited 1 times]

Licentious acrimonious puer æternus. Libertine.
UER Forum > Private Boards Index > Tech Talk > Decrypying EFS (Viewed 2027 times)


Add a poll to this thread



This thread is in a public category, and can't be made private.



All content and images copyright © 2002-2024 UER.CA and respective creators. Graphical Design by Crossfire.
To contact webmaster, or click to email with problems or other questions about this site: UER CONTACT
View Terms of Service | View Privacy Policy | Server colocation provided by Beanfield
This page was generated for you in 93 milliseconds. Since June 23, 2002, a total of 740863842 pages have been generated.