1

My brother formatted my PC, removed the older version of windows 7 and installed a new version. Before he formatted it, I encrypted some files using EFS in windows 7, I was using an account name: AAAA. I do not have the certificates from the older windows version. Can I open the old file that were encrypted using EFS?

4
1

No. Without the private key and certificate associated with the original user (or possibly the Administrator account recovery agent key/cert) you will not be able to decrypt your files. Having a user with the same account name and password won't be enough since a specific EFS key pair is used for the encryption.

If you don't have backups of the original Windows installation with user data then I'm afraid your files will remain inaccessible.

2
  • I read that the symmetric key will be stored in the file. What is the alogirithm and key size, and key space used by EFS. Bruteforcing might be my last resort. – Sari Apr 25 '19 at 16:25
  • Yes, the symmetric file encryption key (FEK) is stored in the metadata of the file, but it is encrypted with the EFS private key associated with your original account. This latter process uses 1024-bit RSA from what I recall, so it's unlikely you'll be able to crack it via brute force. The symmetric encryption uses, at worst, 128-bit DESX, so that is likewise unlikely to be cracked. – PwdRsch Apr 25 '19 at 19:49
1

Simple answer it is not possible. You must have related certificates and User account. Although you create User name which is same to previous account it will not allow to open your files.

I don't think certificate recovery is successful in your case. No answer for your situation because you have already lost key of your door. but you are not able to break.

I think you can take more details by refering this link

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.