Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Here's what I have:

  • Backed up encrypted files
  • Backed up registry files (ntuser.dat)
  • password

The original OS (Windows XP) hosting the EFS encrypted files is gone. I do not have a backed up key file.

Is it possible to recover the encrypted files with the present elements?

Edit: I tried aefsdr from elcomsoft but I didn't see any way to direct it to use the registry file. Also, it didn't find any encrypted files, possibly because the attributes identifying them are absent.

share|improve this question
    
Was the computer a member of a domain? If so, the Recovery Agent certificate is on the domain controller. –  Scott McClenning Jan 22 '10 at 4:11
    
It was not a member of a domain. Thanks for your input, Scott. –  Joel Harris Jan 22 '10 at 5:42
    
I've been looking for where Windows stores the EFS certificates, but I'm thinking you don't have it. I read that ntuser.dat has the fingerprint to the certificates, but not the actual certificates. I've heard of people trying to brute force the certificates, but you can probably guess how long that will take. Sorry and good luck. –  Scott McClenning Jan 22 '10 at 6:03

1 Answer 1

The EFS certificate files can be found in "%userprofile%\Application Data\Microsoft\SystemCertificates\My\Certificates". If you have the Documents and Settings directory from the old machine, you have a backup of the certificates. They are stored each in one file, named by thumbprint, with no extension.

In my quick test here, I was able to move them out, verify that the EFS certificate was gone and EFS files were not accessible, then move them back in on the same machine and had luck. Whether this will work between two machines I have not tested yet. I do not know what format these certificates are stored in.

As an aside, you can also use cert:\CurrentUser\My under Powershell, but that requires a live system, so probably is not relevant to your current question.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.