Just had this yesterday - 4th Jan 2014.
A trojan has installed itself - even with Norton Internet Security installed :-(
Used cipher /U /N command in administrative Command Window to find the encrypted file called HPM3Util.exe in Startup folder which was a Trojan. Used Norton's Power Eraser to clean off.
Hope this helps anyone else...
I found the answer in this Microsoft article:
There are several differences between BitLocker Drive Encryption and
the Encrypting File System. BitLocker is designed to help protect all
of the personal and systems files on the drive Windows is installed on
if your computer is stolen, or if unauthorized users try to access the
computer. EFS is used ...
The existing answer is correct in that the EFS private key is protected by the user's password. However, it is possible to configure EFS Data Recovery Agents that can decrypt any EFS-encrypted file on a system. DRA certificates are set via Group Policy, or Local Security Policy if you don't have a domain.
DRAs have such access because when a system receives ...
This works on every incarnation of Windows since 7 (and probably earlier), and the server versions too.
The SYSTEM account can indeed use EFS, but it doesn't have an EFS certificate by default. The only person who can enroll a certificate for SYSTEM is SYSTEM, so you'll need to get PsExec. From an admin command prompt with psexec.exe accessible, run psexec /...
The user's EFS private key, as well as various other private data kept by Windows, is encrypted using the user's password. If the password is changed, it is impossible to decrypt the private keys, and without that, it is impossible to access the encrypted files.
The answer is, you can't. If you were able to restore access to your encrypted folder without the required certificate, then that would prove any such encryption scheme worthless, wouldn't it? If you do however find somewhere in your backups by chance the Encrypting File System (EFS) certificate, you could follow this procedure to restore access to it and/or ...
It turns out that all I had to do with uncheck Enable strong private key protection in the Import options:
After that I could read the files just fine.
The actual problem seemed to be that checking that option doesn't work for my situation.
If you look at microsoft documentation, they recommend bitlocker AND EFS to fully protect the computer.
This is because bitlocker (or any full-disk encryption) is meant to protect anyone that does not have access to your computer and EFS is meant to protect one user's files from other users, where all users have some form of access to your computer.
This is ...
When you select "apply changes to this folder, sub-folder and files," Windows will encrypt the entire contents of the folder, including all files and subfolders. All new files and folders added within this folder will also be encrypted. Generally speaking, this is the option most people will choose.
When you select "apply changes to this folder" only new ...
I wouldn't say it's correct.
EFS isn't really something you need to enable or disable globally – it's the individual files that can be marked as "encrypted" or not. Newly created files are encrypted only if their parent folder is has encryption enabled.
But if you disable the EFS service, your files won't magically decrypt themselves – they'll remain ...
Windows encrypts files using the transparent Encrypted File System (EFS).
The EFS encryption system is proprietary and is not supported by macOS. Therefore installing the certificate and private key into macOS has no effect as macOS does not know how to handle EFS files.
There might exists third party programs for macOS that make it possible to manually ...
After importing the Encryption key to other pc to access the encrypted files in that PC, will the key be stored in that system forever?
Well, as long as their Windows account exists, and as long as they don't delete the key (e.g. via the Certificate Manager, certmgr.msc). Aside from that, it does not have any self-destruct date.
If the above is true, ...
RichCopy is a Free utility which can remove encryption on the fly while copying
files and folders between NTFS formatted drives. (No need of FAT32 partition to decrypt)
To access the setting, first Check 'Advanced' from
'View' menu. Then go to 'Copy Options' > Default > File attributes,
Error Handling > File atttibutes to remove > Encrypted
It is available ...
You probably can't, and even if you could, it wouldn't do any good.
The SAM file is always in use, and you can't even close the handles to it with Process Explorer running as SYSTEM. Therefore, cipher fails with an access-denied error.
If you encrypted the file with a normal user's key, Windows wouldn't be able to access it (because it needs your password ...
No, the actual file data is encrypted for EFS. For this the system that performs the encryption needs to be able to access the data. If a full file system offers encryption then you do generally need system level access to setup encryption.
Modern encryption act on bits & bytes. The type of file doesn't matter for the encryption procedure; it just acts ...
Perhaps with a batch file you could do something like that :
Create a mycopy.cmd file (in your PATH or in your "user profile directory") with the two lines :
COPY %1 %2
CIPHER /D %2
With the Windows+R keys open the execute dialog en type:
mycopy file-to-be-copied target-directory
If the target directory is always the same you ...
Go to Control Panel -> User Accounts -> User Accounts.
In the left menu, select:
Manage your file encryption certificates
This launches a little wizard:
that lets you view your currently installed certificates, and select which one is your current one:
In my case, after my Windows 10 reinstall i want to use use my existing, backed up, EFS key from ...
As long as you have the files and a backup of your certificate (pfx file) you can always decrypt the files.
The warning you get when setting up the backup is not correct, it does not apply when you do a system image backup (as long as your user directory is on the C drive along with the Windows files). The warning applies only when you just select some ...
If you are logged into your account in a Windows 7 machine, you can encrypt just about all your files by encrypting your user account directory while you are logged into it. While windows' is encrypting the files it won't be able to encrypt files in use, including the key itself. Ignoring all files in use will provide almost all files in your user directory ...
After further analysis, I have reached the following conclusion:
The SSD containing the OS has been failing, causing silent, arbitrary data corruption for at least some days.
The observable effects were — in this order — decreased disk performance, maybe minor unspecific software errors, corruption of an EFS certificate's private key, Explorer ...
EFS is designed to protect files against access in scenarios where an unauthorised user can read the hard disk, for example:
a member of the Administrators group who can change ACL permissions, or
a person with physical access to the computer removing the disk and installing it into another computer over which they have full control
In stand-alone ...
It is not possible to encrypt the SAM database using EFS.
But it is possible to encrypt the SAM database
The feature has existed in Windows since Windows NT 4.0 (1996): SysKey. (archive)
From a command prompt run:
and the UI will appear:
Be aware that it's a one-way operation.
you will have to type in the password every time you boot
User EFS certificates are stored in the user's profile folder, so if the entire folder was encrypted with that key, the key would be inaccessible and the user wouldn't be able to log in! Fortunately, the important files were in use when you ran that command, and so they didn't get encrypted. The profile folder itself is also locked by the system while the ...
Yes, EFS uses hybrid encryption using per-user RSA keypairs (actually self-signed X.509 certificates), and you can import a certificate into Windows' Certificate Manager under "Other People" to use it for file encryption.
When EFS is used by multiple accounts on the same machine, their certificates will even automatically ...
Specifying a user account for running a system service requires specifying
The account data is stored as
LSA Private Data
in the registry under key
Access to this key is rigidly controlled and is not easy and the data is also
encrypted. It is impossible to access even for ...
The encryption you activate is the EFS (Encrypting File System). It is designed to encrypt files while they reside on your local NTFS formatted hard disk.
The encryption is transparent to you; this means whenever you read or modify the encrypted file, Windows automatically decrypts the file for you so you can work with the original decrypted file. As long ...
Because you uploaded the file.
As far as you (as a user) or any programs you run, the files are completely unencrypted.
EFS is designed to protect you against other users who have access to your system, not to protect you from yourself. It's intended use case is where you have a shared drive and a location where you want the data protected from other users,...