We've recently ran into trouble while reinstalling one of client's desktop computer.
Disk was split into two master partitions named
D:. We wiped out
C: and reinstalled system (Win XP SP2 Professional)
Right after we realized there was folder with photos but protected by ciphering (EFS)
That means we have folder with files+folders but both encryption keys are gone.
I've tried to:
- Find at least one of keys via utility for recovering deleted files
- Connecting HDD to domain controller and taking over privileges
but neither worked.
Then I found two sw tools to recover EFS encrypted files (Elcomsoft AEFSDR and Passware EFS), but I think these tools can work only at condition we have one of keys or the key is present in SAM database.
I've got idea, that key could be probably recovered if I can compare encrypted and unencrypted versions of same file, but I haven't found any clue if this is really possible.
So question is:
- Am I wrong about these sw tools?
- If not, is there any way how to recover those files?