Recover EFS encrypted folder after wiping system partition

Question

We've recently ran into trouble while reinstalling one of client's desktop computer.

Disk was split into two master partitions named C: and D:. We wiped out C: and reinstalled system (Win XP SP2 Professional)

Right after we realized there was folder with photos but protected by ciphering (EFS)

That means we have folder with files+folders but both encryption keys are gone.

I've tried to:

• Find at least one of keys via utility for recovering deleted files
• Connecting HDD to domain controller and taking over privileges

but neither worked.

Then I found two sw tools to recover EFS encrypted files (Elcomsoft AEFSDR and Passware EFS), but I think these tools can work only at condition we have one of keys or the key is present in SAM database.

I've got idea, that key could be probably recovered if I can compare encrypted and unencrypted versions of same file, but I haven't found any clue if this is really possible.

So question is:

1. Am I wrong about these sw tools?
2. If not, is there any way how to recover those files?

Answer 1

If the computer was connected to a Windows domain and the files were encrypted by a domain user it is possible you can use the recovery agent to decrypt the files (See http://support.microsoft.com/kb/308993, http://support.microsoft.com/kb/223316). You can use efsinfo.exe to determine this (See http://support.microsoft.com/kb/243026)

In this case you would use not change the permissions on the file you would just decrypt the files using the cipher command (See http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/cipher.mspx?mfr=true) with the recovery agent account (this would likely be the domain administrator but may be configured differently in your environment).

If you have the user’s ntuser.dat file from their profile you may be able to restore this to get the encryption key back. However the user must still be using the same password as when the file was backed up.

Hope this help.

Answer 2

Since the filesystem as not overwritten, you may be able to recover some pieces of the original filesystem.

If the system is not powered on, remove the hard drive from the system and add it to another system as a secondary drive. If the system is powered on, try to power the system off in a way that minimizes writes to the drive. Then attach the hard drive as a secondary drive on another system. The intent here is to preserve as much of the previous filesystem as possible.

Try NTFS file recovery software and see what files are available. For example: TestDisk is a free open source program which is capable of recovering files from deleted NTFS filesystems.

You may be able to recover part or potentially all of the SAM registry. And or you may be able to recover part or all of the user's NTUSER.DAT profile.