Resolved [Lost access to encrypted files after reformat]

Greetings,

I have several files stored in my desktop for backup purposes and I used the said encryption which is then stored in one of my HD, but then last week I reformatted my desktop because logging in take too long.

Now after formatting, I have messed up my company (report) at my laptop then luckily I remembered that I have a back-up of it in my desktop. I opened the folder unzip the compressed files then poof it says "access denied--no archives found" ofcourse I am shocked because I remember I have accessed the files before formatting desktop!.

Digging in, I remembered enabling the encrypt contents function I clicked details and it was set to my old username (before reformat) I clicked add and select my new username then an error pops up "EFSADU--Error in adding new user(s). Error code 5. "

GREAT! now I cant access more than 100 compressed company files in my backup storage!

is there anyway to work around this issue? I really need them, thank you

 

Sorry nkt3310, I don't know any way to access data other than to create the same SID [Security ID] on the computer with which the data was encrypted.

Windows & all OS work with SID's & not user name, so even if you are successful in creating the same user, its SID would not be same & you won't be able to access the data.

More info https://secure.wikimedia.org/wikipedia/en/wiki/Security_Identifier

 

Try this, no guarantee.

http://netinfo.eku.edu/Active_Directory/downloads/psgetsid.exe/view

 

hello I have tried the cipher thing using cmd with no luck, I even bother with reformatting my desktop with the same username and groupname to no avail.

I only got this certificate thumbprint visible in the property window--is that helpful enough to gain access?

I even bothered with the software that claims they can decrypt all encrypted files I think its called AES something forgot the whole filename though.

@mark how do I use the sid retrieval tool? I dl'd it but there's no file extension name in it and it is only named file with 124kb

 

Sorry nkt3310 but that tool is just something I found that I thought may help you out. I was assuming that once downloaded it would be obvious how to use it. I'll have a go with it on my XP installation and see if I can figure it out.

 

nkt3310, it seems from all the research I have done that without your original log in account you have no chance of getting back into these files but don't give up just yet. I have posted the question on another forum which may produce some results, there might just be a backdoor way in. Fingers crossed.

Backing up your important files onto discs and putting them into a safe is the best file protection you can have even if your computer has a major malfunction, is completely destroyed, stolen, etc. We live & learn.

 

That's understood Arie.

Nkt, I have replies from other site but no solution yet.

When you encrypted the files what did you do with the EFS encrypting certificate & the private key. If you have that (not sure how myself) you can import them to another account, apparently.

 

It appears that it is impossible to decrypt the files without your certificates and key. If it helps the file will have a .pfx prefix. Did you not back up all your files before the re-install.

 

sorry for the late response, i havent got an internet connection at home for 1 and 1/2 months, to answer your question mark, I havent backed up my keys... I dont know how too, I am still hopeful that someway I can still decrypt those files.

I tried most if not all security forums that I can find via google and im still waiting for the right way to decrypt my files.

 

As I have already said, without the keys you will never be able to decrypt those files. If it was possible to do there would be no point in encrypting the files in the first place.

If you do find a way to decrypt those files without the key I am sure Microsoft will be very interested.

 

I was wondering... are the files inside the "key" is readable...?

 

If you do not have the "EFS encrypting certificate & the private key" you cannot get access to the files, it is impossible. Next time you encrypt files make sure you back up the cert & key.

The only possibility is to have your hard drive examined by a specialist data recovery company to see if they can find the cert & keys that you deleted in a format but it's a very, very long shot and it will cost you. There is no other way you can decrypt those files.

 

then i guess that is my last option... any reputable company can keep the privacy of my data private?

 

Sorry, I can only suggest you ask around for a company that can do this.

Please mark this thread as resolved from the 'Thread Tools' tab at the top right hand corner of the first post.

 

Thanks