Pics Encrypted With Efs

[The Sorrow]

Backed up my pics on a USB external drive. Formatted my PC that i encrypted them on and now of course I cant view them. Any awesome sauce way to crack EFS encryption?

[digip]

Have you tried moving them to a FAT32 drive(should remove all NTFS settings)? Also, right click on a file, get properties and under the encryption option in advanced, uncheck it (talking windows OS, right?). You might have to first take ownership of the files, but you should be able to remove the encryption or even add a user if you are the admin on the system. Right click it, properties, then advanced, and then details. See if you can add yourself.

[The Sorrow]

I formatted the OS that I encrypted them on and didnt export the cert....

Just tried copying over to FAT32 and it wont remove the encryption. Refuses to copy over in fact.... Maybe because I'm using windows 7? Can I sudo force it onto a FAT32 partition?

Edited August 19, 2011 by The Sorrow

[Infiltrator]

Unless you brute force you may be able to retrieve your pictures, but since your cert has been deleted during the formatting of your HDD. It would be impossible to recover your pics.

Edid: Did you by any chance, back up your profile?

Edited August 19, 2011 by Infiltrator

[iisjman07]

You may want to try this software: http://www.crackpassword.com/products/prs/mswin/efs/, it's not free but Google is always a friend

[Infiltrator]

You may want to try this software: http://www.crackpassword.com/products/prs/mswin/efs/, it's not free but Google is always a friend

Bruting forcing, would be the only option to recover your pics, since the certs are gone. On a side note, did you already install Windows after you formatted your HDD or is your HDD still blank?

[The Sorrow]

Ive installed windows already. Fresh Win7 and its so much faster. Haven't cleaned out stuff in a year or two. Haven't backed up the profile or anything.

And brute force O.o? 3DES? Really?

Edited August 19, 2011 by The Sorrow

[digip]

There is 3rd party software out there to do it, but I have not tried any of them, so can't say it can be trusted or not. You would think that there would be a tool shipped with server 2003 or the like, for admins to recover corrupted systems and files or damaged certificate chains. I imagine there probably is such a tool, I just don't know what that is. From my experience, taking ownership of files and adding yourself as a user has always worked, but then again, I've not shuttled them around from install to install. Have you tried the linux method though, running a live disc and then copying the files off to a fat32 drive, see if that works?

[The Sorrow]

The HD in question is a USB external HD. so i booted a linux mint live and tried copying it over. Says access denied. I was gonna try and copy it with sudo user permissions. Not sure if it'll work though.

[Infiltrator]

The HD in question is a USB external HD. so i booted a linux mint live and tried copying it over. Says access denied. I was gonna try and copy it with sudo user permissions. Not sure if it'll work though.

Access denied, it sounds more like a permission issue. Try Sudo to see if that works!!

[digip]

Try http://www.elcomsoft.com/aefsdr.html and see if the zip download is a trial version. Not sure if it prompts for purchase or if it lets you try it before buying, but looks promising. Also expensive, but if its important data, might be worth having, even for future tools to have.