Decrypt the encrypted files..

[agentsil]

Greeting experts..
I have been experiencing a problem where some of my personal files have been encrypted by windows XP SP3 encryption method.
Then, because of a few reasons, im manage to downgrade my winxp sp3 windows to winxp home edition. Those encrypted files is in another partition. After finish installed a new window xp home version, I can not decrypt back all my encrypted files ..
Why is this happen?
Is it because of the different system environment that will make it possible to decrypt it again?
If is it, how can i get all my data back?
Help me ..
: (

thanx..

[KookyMan]

You have to have XP Pro to support NTFS Encryption, XP Home doesn't support it to my knowledge. Also, the encryption is tied to the user account and password, so I have a feeling that the data is a lost case.

From 5 minutes of Googling, it appears that "lost" is a correct term in this case if you reformatted the system, as the keyfiles that were originally used to encrypt the data are gone.

You may be able to find some software out there that can brute force, however if it is possible (or simple) NTFS EFS would be useless so I doubt you have much hope of recovery.

[agentsil]

Originally Posted by KookyMan

You have to have XP Pro to support NTFS Encryption, XP Home doesn't support it to my knowledge. Also, the encryption is tied to the user account and password, so I have a feeling that the data is a lost case.

From 5 minutes of Googling, it appears that "lost" is a correct term in this case if you reformatted the system, as the keyfiles that were originally used to encrypt the data are gone.

You may be able to find some software out there that can brute force, however if it is possible (or simple) NTFS EFS would be useless so I doubt you have much hope of recovery.

OMG! really!? if so..all my 25gb data would lost forever then..
well.. i really hope in future our encrypt/decrypt technologies are growing fast plus forensic tool are more advance/useful than today releases which in my hope it would help me a bit or better.. thanx for the feed KookyMan..

[Keyboard_Commando]

If you cannot afford to lose these encrypted files ... you can probably have them recovered via professional services. Before you write them off as irretrievable ... check out how much it costs to have EFS encrypted files recovered. For the average user brute forcing them is a lot of hair tearing out experiences.


(this is too late for this case, but) There is a way to backup certs and reapply them if your system screws up. Start/Run/type: certmgr.msc /right click certificates current user, and click export/save somewhere safe.

If you ever need to retrieve encrypted files again you simply import the saved certs.

[kakaka]

http://www.beginningtoseethelight.or...very/index.php

[ha14]

The othere way is to take the file on an other pc with windows xp and try there.

Alternatively they are some boot cd that have windos xp on it, then just boot and try there.

Or you can set a virtual environment such ad daemon tool then try an iso cd of a windows xp there some circulating on the web and try to decrypt there.

[dantz]

I'm not an expert on this, but I'm pretty sure XP Pro prompts you to back up the keys/certificates when you set up EFS. Did you? Maybe you've got them sitting on a disk somewhere. If so then you can probably use them with another XP Pro installation to recover your files.

If you don't have a backup but you think the keys might still exist somewhere on your drive then try this link: http://www.elcomsoft.com/aefsdr.html