Friend of mine sent me on this little project to save his dad's files.

Is there a way to decrypt files from a Windows XP system that was encrypted? I have the drive pulled and would like to access the files.

Are the files encrypted based on the password so if you know the password you can decrypt them or are there private keys in play here?

I assume I could maybe pull the password from the SAM file or would that not work if this was a network account.

This is not BitLocker. This is the Windows XP encryption system.

EDIT: I have the password. What would be the way to go about getting the key decrypted to decrypt the rest of the files?

  • Just to be sure, we’re talking about NTFS encryption here, right? The files are marked green in Explorer by default. – Daniel B May 6 '14 at 6:57

Similar to how PGP works, each Windows EFS user has a private key (an X.509 certificate, usually generated automatically by Windows) that is used to protect each file's symmetric "file encryption keys". The private key itself is protected using (but not based on) the user's login password, and kept in the standard Windows user certificate store.

If you know the password, you should be able to use some-or-other recovery tool that would decrypt the user's "DPAPI Master Key", with it the private key used by EFS, and the files themselves (or at least allow the certificate & key to be imported to the running system).

  • If the file was encrypted by Windows then its locked to that machine. Easier to decrypt the file on the machine it was encrypted then attempt to do what you describe. – Ramhound Jul 12 '14 at 5:37
  • It's not locked to the machine. It's locked to the private key held in your Windows account. The private key can be copied between machines. Windows 7 even prompts you to make a backup. – user1686 Jul 13 '14 at 6:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.