10

I made a backup of the old Win 7 Pro then did a clean install. But I forgot to export my EFS encryption certificate, so when after I restored the encrypted files from backup I could no longer access them. Up to here, no surprise.

I then researched and discovered that certs are stored in the C:\Users\username\AppData\Roaming\Microsoft\SystemCertificates\My\ folder. I went to that location in the backup and restored the Certificates and the Keys folders to the same location in the new install.

Now, when I open the EFS certificate manager (not the MMC cert manager) it asks me to select or create a personal certificate. I can browse thru all the old machine's certs (which now are available, since I restored the cert files from the old machine). I can select the certs that seem to be the personal certs (cert name is my username), but the EFS certificate manager does not allow me to use any of these certs: "cannot find the certificate and private key for decryption". One would imagine in the keys folder you'd find the private keys, and in the certs in the certificates folder. It IS, after all, reading certs from this location where I dropped the backup files - before I restored the backup, EFS certificate manager had no certs to display.

When I open the Certificate Manager MMC, I see the same dozens of certs brought in from the old machine via backup. To my surprise, when I click on each of those two certs certmgr tells me that I "have a private key that corresponds to this certificate". Great! But if I try to export these same certs it tells me that the associated private key could not be found (whatever, Windows!)

I wrote all of the above to ask this: WHERE from the backup do I retrieve the certs and private keys? These answers don't apply to my situation.

PS: Worst case scenario I know I can bring the old system back online from backup and export the cert. But I'm really trying to avoid doing this.

Improve this question

4 Answers 4

Reset to default
3

  1. Maybe your restored files from the old machine have broken the link between EFS certificates and their associated private keys.

  2. So, try to use Mimikatz 2.0 on the old machine http://blog.gentilkiwi.com/mimikatz/crypto#exportKeys with admin privilieges

    • using the crypto::exportKeys function, you can export the private keys (just pay attention to your ACL on the files)

    • using the crypto::patchcapi function, you can patch the Windows CryptoAPI provider loaded in mimikatz. Then, the « non exportables » private keys becomes « exportables » :)

Improve this answer
1
  • This could work, thanks. I will leave the answer here for future reference. I long ago solved the problem, by bringing the old system back online from backup and exporting the cert.
    – Gaia
    Commented Mar 6, 2014 at 15:31
1

It boils down to the private keys being entangled with the user's password. There are no existing tools to automate the extraction even if you know the password.

How Private Keys Are Stored

Improve this answer
1

AFAIK there is no way around it. You have to boot into the old system, export the certificate with the corresponding private key and save it (I saved it as PFX).

I then brought the file into another system (BTW a different laptop, thus different TPM) and logged in using the same username & pword as the previous machine. I was able to successfully import the PFX into my personal certificates store.

I can confirm this works for purposes of accessing EFS protected files.

PS: I did not need to use the tool recommended by @Td6 in his answer.

Improve this answer
-1

This might be what you're looking for:

DPAPI Secrets

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .