Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I made a backup of the old Win 7 Pro then did a clean install. But I forgot to export my EFS encryption certificate, so when after I restored the encrypted files from backup I could no longer access them. Up to here, no surprise.

I then researched and discovered that certs are stored in the C:\Users\username\AppData\Roaming\Microsoft\SystemCertificates\My\ folder. I went to that location in the backup and restored the Certificates and the Keys folders to the same location in the new install.

Now, when I open the EFS certificate manager (not the MMC cert manager) it asks me to select or create a personal certificate. I can browse thru all the old machine's certs (which now are available, since I restored the cert files from the old machine). I can select the certs that seem to be the personal certs (cert name is my username), but the EFS certificate manager does not allow me to use any of these certs: "cannot find the certificate and private key for decryption". One would imagine in the keys folder you'd find the private keys, and in the certs in the certificates folder. It IS, after all, reading certs from this location where I dropped the backup files - before I restored the backup, EFS certificate manager had no certs to display.

When I open the Certificate Manager MMC, I see the same dozens of certs brought in from the old machine via backup. To my surprise, when I click on each of those two certs certmgr tells me that I "have a private key that corresponds to this certificate". Great! But if I try to export these same certs it tells me that the associated private key could not be found (whatever, Windows!)

I wrote all of the above to ask this: WHERE from the backup do I retrieve the certs and private keys? These answers don't apply to my situation.

PS: Worse case scenario I know I can bring the old system back online from backup and export the cert. But I'm really trying to avoid doing this.

share|improve this question

2 Answers 2

  1. Maybe your restored files from the old machine have broken the link between EFS certificates and their associated private keys.

  2. So, try to use Mimikatz 2.0 on the old machine http://blog.gentilkiwi.com/mimikatz/crypto#exportKeys with admin privilieges

    • using the crypto::exportKeys function, you can export the private keys (just pay attention to your ACL on the files)

    • using the crypto::patchcapi function, you can patch the Windows CryptoAPI provider loaded in mimikatz. Then, the « non exportables » private keys becomes « exportables » :)

share|improve this answer
    
This could work, thanks. I will leave the answer here for future reference. I long ago solved the problem, by bringing the old system back online from backup and exporting the cert. –  Gaia Mar 6 at 15:31

This might be what you're looking for:

DPAPI Secrets

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.