No announcement yet.

Windows EFS (Encrypted File System)

  • Filter
  • Time
  • Show
Clear All
new posts

  • Windows EFS (Encrypted File System)

    Hi folks,

    Does anyone here know how to access or de-crypt these files?

    Scenario is as follows:
    Backed up some files on a USB hard disk (Drive E: )
    Encrypted them.
    Reformatted the C: drive.
    Recreated the same (?) user account with same password.

    Now I can't access the files...

    I've tried a couple of proggies like Passware.Kit.v7.5, Advanced EFS Data Recovery v3.0 (keeps crashing)

    Done a bit of reading, seems what I should have done is either saved a copy of the .SAM file or exported a private key certificate.

    It's a European version of windows so the key is probably 40 bit.
    Anyone heard of brute force breaking it?

    Any help appreciated

  • #2
    Shameless bump.

    Think I now know the answer to this one but maybe someone has some ideas?

    Would keys ever end up in the System Volume Information folder on the drive root?


    • #3
      I have done a good bit of research on this. I was once in a similar situation, though fortunately I had not formatted the installation of windows. If you formatted, you have no way of recovering your old sid, key, or backup of a key. I know you're going to be upset to see that when you finally get a reply, it is only telling you that you're ****ed... but... well... sorry...


      • #4
        Well the more I searched, the more I wished I didn't.
        It seems well and truly certain that without a key it's a no-go.
        My only hope is that somewhere I've inadvertently backed a key up.
        All the "recovery" programs do is check the SAM file or \protect folder for keys... Without a key this is a bloody secure system.

        Thanks for the reply anyhow.