Member Avatar for PRAKHAR

Hi

6 months ago, i encrypted all my documents and other data using windows encryption(windows XP pro). I have 2 partions C and D (each 20 GB). Windows is installed on C where as all my professional data is on D. MY Windows got corrupt so my computer guy formatted C drive and reinstalled XP on C. (the xp cd used this time was different from the one last time, beacause i misplaced the ist one).the D drive was left untouched.

However the encrption remained as it is and now ,because i changed the windows, it prevents me from viewing the data. Wnenever i try to open or even move the file, a message "ACCESS DENIED " appears.

i am realy stuck and my professional life is suffering .please help.

iam on windows XP -SP2.

  • 5 Contributors
  • 12 Replies
  • 267 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by PRAKHAR

Dani AI

Generated

Short, practical summary and next steps (for and anyone else reading years later)

What happened: Encrypting File System (EFS) ties each encrypted file to a user certificate and its private key. If those keys were lost when C: was formatted and the old user profile removed, Windows cannot decrypt the files — this is how EFS protects data, and it also means there is no “back door” if the key is gone. ’s assessment is the common case, but there are concrete checks to confirm whether recovery is still possible. (learn.microsoft.com)

Checklist (try these in order)

  1. Verify the files are EFS-encrypted (Explorer shows a lock/green name, or use the cipher command to list encryption status). If they are not encrypted, normal permission fixes may be enough. (learn.microsoft.com)
  2. Search for any exported certificate/private-key backups (.pfx or .p12) on CDs, USB sticks, old backups, or the D: drive. Also look for an old user profile or a Windows.old folder — sometimes the private key files are under %APPDATA%\Microsoft\Crypto\RSA\{SID} and the DPAPI master keys under %APPDATA%\Microsoft\Protect\{SID}; if those files exist you may be able to recover the key. (learn.microsoft.com)
  3. If you find a .pfx, import it with certmgr.msc (or double‑click and import) into the original user account or into a recovery agent account, then you can decrypt the files. The cipher tool can also export/import EFS keys (/x and /r options). (learn.microsoft.com)
  4. If the PC was domain‑joined, ask the domain admin about a Data Recovery Agent (DRA) — DRAs are designed to recover EFS files. (learn.microsoft.com)

Notes and cautions

  • Third‑party tools can sometimes find leftover key material on a disk image, but they cannot break strong encryption if the private key really was erased. ’s suggestion of recovery tools is valid only when key material still exists; already reported that a tool didn’t find keys. (learn.microsoft.com)
  • Avoid destructive “magnet” or physical tricks: they will destroy the drive and the data. If no backup, no DRA, and no recoverable key files are found, the files are effectively unrecoverable — that is by design. (learn.microsoft.com)

For future setups: export your EFS certificate/private key to a securely stored .pfx (or use domain DRAs) before you reinstall or format. See Microsoft documentation for the recommended export/backup steps. ()

Recommended Answers

All 12 Replies

Member Avatar for PRAKHAR

please anyone help!!!!!!

Member Avatar for Catweazle

Sorry, but it's gone!

The encryption needs to be removed using the user account it was created with. If the drive has been formatted and reinstalled, then I'm afraid there's no way to retrieve the data.

1. Your computer guy should have known that.
2. People should NOT use such features without first determining how they operate.

Member Avatar for antioed

Interesting article on a utility that sounds like it would work for this:

Here's the home page for the software:

http://www.elcomsoft.com/aefsdr.html

Tucows has a 30 day trial download:

Member Avatar for Catweazle

That certainly is interesting! Thanks for the heads up.

Member Avatar for Piddyful

I had the same problem myself not too long ago. I hate to say I was used to WinME and how I could have multiple partitions and format/reload C: and still keep my other files and programs intact like nothing special had happened. Well, not only does Win2k/xp have encryption but just dealing with permissions is frustrating enough. Win2k is so stable of an OS that it took almost a year to have to reload C: (due to Direct X 9.0c before my games happened to implement it, couldn't connect to even one online). Anyways, I made sure that my group policy allowed for local auditing of permissions, owners, etc. and then I think I first removed the inherited permissions then changed to owner to my current admin account then created all new permissions to be able to access my fies, but truly I think that anything I had encrypted I had to delete. It would be interesting to have to try it again. I've learned a few things since I had to that particular time.

Member Avatar for PRAKHAR

Will The Elcom Software Really Help Me?? I Will Purchase It If Required , And It Seems That It Will Work.

Member Avatar for PRAKHAR

Sorry To Say The Efs Data Recovery Software Did Not Work Obviously No Keys Were Found.

My Computer Guy Has Suggested Some Technique Using Magnetic Fields And Something Like That To Break The Protection On The Hard Drive And Says That It Can Remove The Encryption.

Iam Not To Sure . Please Suggest

Member Avatar for Catweazle

I think that using magnetic fields on your hard drive is likely to remove EVERYTHING!

Member Avatar for PRAKHAR

To Catweasle,

I Know That It Is Almost Impossible To Recover Data. Cant Anyone Do Anything??? What If I Got Hold Of The 1st Cd With Which I Installed Xp . Will It Help????

By Anychance, Can Those Files Run On Any Other Computer.
I Know Those Files Cannot Be Moved. But What If I Created A Backup Of Them And Then Move The Backup To Another Computer???

Please Help!!!

Member Avatar for bentkey

The potential for this problem is why I once suggested in another thread that I would never use windows encryption. It is tied to the user security ID and that will always be lost if you completely remove the OS. No good encryption algorythm is breakable unless you have the key. Before you replace the OS, the key still exists somewhere in the entrails of windows, and it is probably possible to retrieve it with the right software, once you format and reinstall, I can't imagine anything being able to get it back. Sorry. FYI there are 3rd party applications that can save and encrypt your data and that don't tie themselves to the windows user. With one of these, you could always just reinstall the application and then recover your data. But that's for next time.

Member Avatar for Catweazle

And next time, please accept that blank CDs are not only extremely inexpensive, they are the best security your data can have. If data is crucial, it deserves daily backups.

Member Avatar for PRAKHAR

Thanks For Everything!

Bye

:sad:

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.