Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We've recently ran into trouble while reinstalling one of client's desktop computer.

Disk was split into two master partitions named C: and D:. We wiped out C: and reinstalled system (Win XP SP2 Professional)

Right after we realized there was folder with photos but protected by ciphering (EFS)

That means we have folder with files+folders but both encryption keys are gone.

I've tried to:

  • Find at least one of keys via utility for recovering deleted files
  • Connecting HDD to domain controller and taking over privileges

but neither worked.

Then I found two sw tools to recover EFS encrypted files (Elcomsoft AEFSDR and Passware EFS), but I think these tools can work only at condition we have one of keys or the key is present in SAM database.

I've got idea, that key could be probably recovered if I can compare encrypted and unencrypted versions of same file, but I haven't found any clue if this is really possible.

So question is:

  1. Am I wrong about these sw tools?
  2. If not, is there any way how to recover those files?
share|improve this question
    
Do you still have the user profiles ("Documents and Settings")? And no, known-plaintext attacks on AES do not currently work. –  grawity Oct 9 '11 at 10:11
    
Maybe in some user backups i can found. Can you please provide answer with manual what to do if I will find it? Thanks –  Marek Sebera Oct 9 '11 at 10:37
1  
It's possible to reimport the keys from old profiles. (It may or may not involve voodoo and prolonged head-banging.) –  grawity Oct 9 '11 at 10:45
1  
However, it seems that at least Elcomsoft's program can recover the files without requiring SAM, so please try that first. –  grawity Oct 9 '11 at 10:46
    
You say you wiped the C: partition. Did you change the C: partiton size? Did you reformat the filesystem on C: ? Did you perform a secure overwrite on the C: filesystem before installing the new system? What filesystem was on the C: partition before you wiped it, NTFS? –  this.josh Oct 11 '11 at 7:48

2 Answers 2

up vote 3 down vote accepted

If the computer was connected to a Windows domain and the files were encrypted by a domain user it is possible you can use the recovery agent to decrypt the files (See http://support.microsoft.com/kb/308993, http://support.microsoft.com/kb/223316). You can use efsinfo.exe to determine this (See http://support.microsoft.com/kb/243026)

In this case you would use not change the permissions on the file you would just decrypt the files using the cipher command (See http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/cipher.mspx?mfr=true) with the recovery agent account (this would likely be the domain administrator but may be configured differently in your environment).

If you have the user’s ntuser.dat file from their profile you may be able to restore this to get the encryption key back. However the user must still be using the same password as when the file was backed up.

Hope this help.

share|improve this answer
    
good point, but that computer was personal, I just tried to override ownership with domain. Account was previously without password. In fact it was recover of OEM WXP after some HW failure. –  Marek Sebera Oct 11 '11 at 11:28

Since the filesystem as not overwritten, you may be able to recover some pieces of the original filesystem.

If the system is not powered on, remove the hard drive from the system and add it to another system as a secondary drive. If the system is powered on, try to power the system off in a way that minimizes writes to the drive. Then attach the hard drive as a secondary drive on another system. The intent here is to preserve as much of the previous filesystem as possible.

Try NTFS file recovery software and see what files are available. For example: TestDisk is a free open source program which is capable of recovering files from deleted NTFS filesystems.

You may be able to recover part or potentially all of the SAM registry. And or you may be able to recover part or all of the user's NTUSER.DAT profile.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.