Encrypted files

[srynznfyra]

Recently some damage happened to a user account with lots of encrypted files (virus or something), and now the files aren't accessible, even with that account (which is the original account that encrypted the files in the first place). When trying to decrypt the files, all I get is 'access denied'.

There is a program, 'Advanced EFS data recovery' by Elcomsoft, which can recover the files, however it costs an arm and a leg and I'm wondering, if that program can recover the files then surely why can't I?

The program searched for a 'certificate' (it scanned the whole drive) with which to decrypt the data, I'm wondering, once I have this certificate to hand how I can decrypt the data manually with it?

This data is very important so any help is much appreciated.

Thanks in advance

 

[NoN]

You mean you'd created a 'certificate' to encrypt your files, then never backed it up on a usb stick drive...

On the first crash/damage, you couldn't recover those files unless taking back the certificate.

If you are on 7 Ultimate you can use that EFS Application Tab:

-Encrypt or Decrypt a Folder or File - Vista Forums

-Encrypted File System (EFS) Certificate Backup - Vista Forums

-Encrypted File System (EFS) Certificate Restore - Vista Forums

Those tutorials might give you an hand...

 

[srynznfyra]

You mean you'd created a 'certificate' to encrypt your files, then never backed it up on a usb stick drive...

On the first crash/damage, you couldn't recover those files unless taking back the certificate.

If you are on 7 Ultimate you can use that EFS Application Tab:

-Encrypt or Decrypt a Folder or File - Vista Forums

-Encrypted File System (EFS) Certificate Backup - Vista Forums

-Encrypted File System (EFS) Certificate Restore - Vista Forums

Those tutorials might give you an hand...

Thanks, yeah it's 7 Ultimate, I'll have a look at those links, cheers

EDIT: No, had a look at those links, didn't help

Basically this is the situation: the files are encrypted and the only user that can decrypt them has an SID that doesn't match any SID of any user on the system, for an unknown reason - I know which account encrypted them, it still exists, yet seems to have a different SID now :/

There must be a way of decrypting them, seeing as the program can do it. The certificate for the lost account must exist somewhere on the hard drive.

cheers

 

[NoN]

You mean you'd created a 'certificate' to encrypt your files, then never backed it up on a usb stick drive...

On the first crash/damage, you couldn't recover those files unless taking back the certificate.

If you are on 7 Ultimate you can use that EFS Application Tab:

-Encrypt or Decrypt a Folder or File - Vista Forums

-Encrypted File System (EFS) Certificate Backup - Vista Forums

-Encrypted File System (EFS) Certificate Restore - Vista Forums

Those tutorials might give you an hand...

Thanks, yeah it's 7 Ultimate, I'll have a look at those links, cheers

EDIT: No, had a look at those links, didn't help

Basically this is the situation: the files are encrypted and the only user that can decrypt them has an SID that doesn't match any SID of any user on the system, for an unknown reason - I know which account encrypted them, it still exists, yet seems to have a different SID now :/

There must be a way of decrypting them, seeing as the program can do it. The certificate for the lost account must exist somewhere on the hard drive.

cheers

This what i found here:
5-Minute Security Advisor - Recovering Encrypted Data Using EFS

 

[SiliconAddict]

Recently some damage happened to a user account with lots of encrypted files (virus or something), and now the files aren't accessible, even with that account (which is the original account that encrypted the files in the first place). When trying to decrypt the files, all I get is 'access denied'.

There is a program, 'Advanced EFS data recovery' by Elcomsoft, which can recover the files, however it costs an arm and a leg and I'm wondering, if that program can recover the files then surely why can't I?

The program searched for a 'certificate' (it scanned the whole drive) with which to decrypt the data, I'm wondering, once I have this certificate to hand how I can decrypt the data manually with it?

This data is very important so any help is much appreciated.

Thanks in advance

Errr. Is this what you are talking about? Crack password : Download fastest password recovery, forensic and system security software. Forgot your password? Lost passwords recovery tools, passwords crackers, system security and forensic software. Advanced EFS Data Recovery

It says there is a 30 day trial. UNless one of the restrictions is you can't restore use it and uninstall it.