0

EDIT: it seems that the partition is encrypted with a full-disk encryption software that uses TPM—I don't see any other way the partition could be looking like it's fully encrypted, while at the same time, the computer boots up just fine without any boot-time authentication. If that's the case, am I out of luck getting the files back? Any ideas?

My situation is the following:

  1. without anticipating the consequences, I removed a domain-joined Windows account from the domain
  2. this seems to have rendered the user account inaccessible—it won't let me in with the username-password pair that was previously working fine
  3. I booted up the computer with a Ubuntu Live CD, however, mount fails on the partition (/dev/sda1), and gparted says it can't recognize the file system on the partition
  4. I've written a quick Python script to see if the partition contains any ASCII sequences, but the only thing the script was able to find was a short bootstrap related ASCII string at the very beginning of the partition; from there on, it was just binary (for comparison, I've run the same script on a partition that is known to be unencrypted and it gave a lot of results, so it's safe to assume the script is not faulty; here it is: http://pastebin.com/7Pn5rrvZ; it should process about 15-20MB/sec of data on PyPy 2.0)

I've copied the raw dd image of the partition over to another (OS X) computer, then converted it to the VMDK format using qemu-img, but Parallels fails to mount the image.

I'm know in the process of dd-ing the partition to an external hard drive instead and then mounting that physical partition (as opposed to a disk image) to my Parallels running Windows 7 instead, to see if I can then somehow try to access the partition.

On the positive side, I do have an old backup of the system, containing the home directory of the previously domain joined user account, which also contains the Application Data\Microsoft\Crypto, Application Data\Microsoft\Protect and Application Data\Microsoft\systemcertificates folders, which should be where Windows keeps some sort of certificates or keys of the encryption. From this I assumed the partition was encrypted with the built-in EFS mechanism and not some 3rd party encryption tool.

It's a Windows XP partition, for the record.

I'm looking for suggestions on how to go about recovering the files from the partition.

The list of EFS related files in the old backup is here: http://pastebin.com/raw.php?i=h9J5rgvk

P.S. it's the entire PARTITION I can't access not just a folder on it. Also, I'm not 100% sure it's EFS encrypted; I haven't been able to determine if EFS is even capable of encrypting an entire partition.

2

0

You must log in to answer this question.

Browse other questions tagged .