Encrypted File System HELP !


Recommended Posts

Damn.. I should have known better.. as a computer a technician for a number of years, I see stuff like this time and time again but I think I am screwed.

I enabled EFS on a folder on a previous Windows XP install just to test EFS out, and promptly forgot that I had done that. I have just reinstalled XP this afternoon to find that I can no longer view any of the files in that folder. There was over 3GB of data in there !!

Is there any way to circumvent, or disable EFS so I can view these files again?? Any help would be appreciated.. running Windows XP Professional.

Link to comment
Share on other sites

Ah.. might as well forget about it. Just read some other peoples problems with EFS and it looks like I am boned. Damn.

Link to comment
Share on other sites

Ok, I had the same problem, and this was the help I was given on an earlier thread.

I can confirm it works a treat:cool:

To get at your documents on Windows XP after moving the hard drive, or installing a 2nd HD and booting from it:

1. Open My Computer (logged in as an Admin)

2. Go to Tools, Folder Options, View tab

3. Uncheck "Use simple file sharing"

4. Click OK

5. Right click the folder that contains your files

6. Go to the security tab

7. Click Advanced

8. Go to the Owner tab

9. Click Administrators and check Replace owner on subcontainers and objects.

10. Click OK twice, and your set.

What this does is changes the owner of the files to the administrator on the new XP install. This needs to be done because each user name is given a Security ID number that is different with each install of XP. Since the file's security settings did not list the new administrator's ID number as having access to the file, you got an "Access Denied" message. But as an Administrator you have the privilage to give yourself access, as long as the file was not encrypted. Hope that explains well enough

Link to comment
Share on other sites

when using EFS, winnt will create a public key and encrypt it to it. that key is associated with your user account, which is stored in the registry (to be precise in the SAM). that part is protected and encrypted by NTOSKRNL. noone managed to hack keys out of that. a reinstall won't generate the same public key, and since you're unable to retrieve it, you're screwed.

taking over ownership wont give you your key back either. i think madscientist had a different problem. especially coz EFS would be useless if taking over ownership would circumvent it.

Link to comment
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.