0

Friend of mine sent me on this little project to save his dad's files.

Is there a way to decrypt files from a Windows XP system that was encrypted? I have the drive pulled and would like to access the files.

Are the files encrypted based on the password so if you know the password you can decrypt them or are there private keys in play here?

I assume I could maybe pull the password from the SAM file or would that not work if this was a network account.

This is not BitLocker. This is the Windows XP encryption system.

EDIT: I have the password. What would be the way to go about getting the key decrypted to decrypt the rest of the files?

Improve this question
1
  • Just to be sure, we’re talking about NTFS encryption here, right? The files are marked green in Explorer by default.
    – Daniel B
    May 6, 2014 at 6:57

1 Answer 1

Reset to default
1

Similar to how PGP works, each Windows EFS user has a private key (an X.509 certificate, usually generated automatically by Windows) that is used to protect each file's symmetric "file encryption keys". The private key itself is protected using (but not based on) the user's login password, and kept in the standard Windows user certificate store.

If you know the password, you should be able to use some-or-other recovery tool that would decrypt the user's "DPAPI Master Key", with it the private key used by EFS, and the files themselves (or at least allow the certificate & key to be imported to the running system).

Improve this answer
2
  • If the file was encrypted by Windows then its locked to that machine. Easier to decrypt the file on the machine it was encrypted then attempt to do what you describe.
    – Ramhound
    Jul 12, 2014 at 5:37
  • It's not locked to the machine. It's locked to the private key held in your Windows account. The private key can be copied between machines. Windows 7 even prompts you to make a backup.
    – u1686_grawity
    Jul 13, 2014 at 6:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .