Possible Duplicate:
Getting Through EFS (Encrypted File System)

My dad encrypted a file on a PC running Win XP. He got a new PC running Win 7. There were some files encrypted using Windows EFS from the old XP OS in a pen drive, and now we're unable to figure out how to open the same. Help please.

-- Ram

  • Not a programming question. – Oliver Charlesworth Jun 17 '12 at 13:56
  • Do you still have the old PC? Can you start WinXP and log in to the old account? – user1686 Jun 17 '12 at 14:04
  • @OliCharlesworth: I know it's not a programming question. However, I was not sure which forum to post this into. Please excuse. Also, if you see techie007's comment, there are a few more questions of the same kind. – Ram RS Jun 17 '12 at 14:21
  • 1
    @RamakrishnanRS: In that case, the data is most likely lost. Even Elcomsoft's tool appears to require access to the old system in order to retrieve the keys. – user1686 Jun 17 '12 at 14:28

Unless your dad made a backup of the encryption keys that were on his old laptop, associated with his user-Id on that machine, data in any file encrypted with those keys is now lost.

Microsoft say

By far, the most frequent problem with EFS occurs when EFS encryption keys and/or recovery keys aren't archived. If keys aren't backed up, they cannot be replaced when lost. If keys cannot be used or replaced, data can be lost. If Windows is reinstalled (perhaps as the result of a disk crash) the keys are destroyed. If a user's profile is damaged, then keys are destroyed. In these, or in any other cases in which keys are damaged or lost and backup keys are unavailable, then encrypted files cannot be decrypted. The encryption keys are bound to the user account, and a new iteration of the operating system means new user accounts. A new user profile means new user keys. If keys are archived, or exported, they can be imported to a new account. If a revocation agent for the files exists, then that account can be used to recover the files. However, in many cases in which keys are destroyed, both user and revocation keys are absent and there is no backup, resulting in lost data.

File encryption uses a symmetric key, which is then itself encrypted with the public key of a public key encryption pair. The related private key must be available in order for the file to be decrypted. This key pair is bound to a user identity and made available to the user who has possession of the user ID and password. If the private key is damaged or missing, even the user that encrypted the file cannot decrypt it. If a recovery agent exists, then the file may be recoverable. If key archival has been implemented, then the key may be recovered, and the file decrypted. If not, the file may be lost. EFS is an excellent file encryption system—there is no "back door."

(my emphasis)

  • Extremely detailed explanation, @RedGrittyBrick! Sad news, but a conclusion to the problem nonetheless! Thanks a lot! – Ram RS Jun 17 '12 at 15:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.