XP File Protection: Decryption

[Hourglass]

I hvae alot of pictures that for some reason or another get encrypted using xp pro's built-it fire protection feature. The drive that the files pics as since been moved to another system in which the original hdd that xp was on has been reformatted. i can't see any previews or edit them in xp pro.

is there a program or something i can get to remove the file protection. i really don't want to loose these photos.

thanks

 

[drizzt81]

if they are encrypted, it is rather likely that you will need the key from the old install.

 

[nodle]

I think i used a live Linux cd once for a customer and was able to see the files then i transfered them to a external drive. Knoppix i believe? Maybe a different distro. It has been awhile since i did it.

 

[bashPenguin]

You will need the EFS private key to get to the files, and if you've already formatted the XP install where these files were encrypted previously, you are pretty much boned.

I think i used a live Linux cd once for a customer and was able to see the files then i transfered them to a external drive. Knoppix i believe? Maybe a different distro. It has been awhile since i did it.

Are you sure this worked? The files should still be encrypted and would still need to be explicitly decrypted. Unless there is some major flaw that allows you to do such a workaround, I doubt just using Linux could bypass the encryption scheme used in EFS, but I have never seen this.

 

[mket]

I had a similar problem. i had an external HD which I had encrypted various folders and files then reloaded my os. my files on the external were lost. I found this link

 

[Hourglass]

do you think there's any way for some program to just read the binary on the drive or something crazy like that?

maybe, like, delete and recover the drive with a recover program?

 

[Hypernova]

do you think there's any way for some program to just read the binary on the drive or something crazy like that?

maybe, like, delete and recover the drive with a recover program?

That's useless, the files are still encrypted as in scrambled.

 

[nessus]

I think i used a live Linux cd once for a customer and was able to see the files then i transfered them to a external drive. Knoppix i believe? Maybe a different distro. It has been awhile since i did it.

This would allow you to access files that had file system access rights restricted, but not encrypted files. The really easy way is to just take ownership of the files while logged on with admin access.

Unless you exported the EFS keys for the user who encrypted the files before you wiped the machine, or you have a ghost copy of that old OS install so you can restore it and log on as the local admin account to use its file recovery rights and encryption keys for that particular install for file recovery one file at a time, you are done.