Hi,
I have some files that I encrypted using the inbuilt encryption
function in Windows XP Pro. However, this installation of windows
became corrupt and unbootable somehow. I have installed a new copy of
windows to a different partition.

I know that normally this would prevent the contents of the encrypted
files being recovered, but I have retained the encrypted files and the
Documents and Settings folder relating to the user account with which
the files were originally encrypted. I'm not sure, but I think that
there may be other recoverable files from the original windows install
too. I am hoping that I have managed to retain sufficient files from
the original install of Windows to be able to create an account which
will decrypt the files.

I still have the installation disks for XP Pro, so I can make another
fresh install on a separate partition and then edit that as required
in order to create conditions whereby the files may be decrypted.

My question is:
How can I decrypt the files? I'm after a step by step guide please.

Thanks

---

Request for Question Clarification by livioflores-ga on 31 Dec 2005 04:53 PST

Hi!!

Not sure if this is what you need, so this is why I posted it as a
request of a clarification, check if the following links are usefull
and let me know the results in order to post this in the answer box
and claim the price or to continue researching.
Thank you.

Visit the following pages for step by step instructions:
"TweakXP.com - De-crypt Encrypted files on Windows XP":
http://www.tweakxp.com/article37355.aspx

or may be this one do the trick (it sounds more advanced):
"encrypted file system recovery":
http://www.beginningtoseethelight.org/efsrecovery/index.php

The following program claims to recover the encrypted files, you can
try with the trial version:
"ELCOMSOFT: Advanced EFS Data Recovery":
Advanced EFS Data Recovery (or AEFSDR) is a program to recover
(decrypt) files encrypted on NTFS (EFS) partitions created in Windows
2000, Windows XP and Windows Server 2003.
http://www.elcomsoft.com/aefsdr.html


For additional reference see:
"Encrypting File System in Windows XP and Windows Server 2003":
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/cryptfs.mspx

See also this chapter at Microsoft's support site for better understanding:
"Ch 17 Encrypting File System":
http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-us/prnb_efs_qutx.asp

Hope this helps. I am looking fordward your reply.

Regards, livioflores-ga

---

Clarification of Question by mrmr96-ga on 04 Jan 2006 01:02 PST

Hello,

I found http://www.elcomsoft.com/aefsdr.html myself before posting the
question. (The demo did work in part: It is limited to the first few
bytes of each file, but some very small files were recovered in full
however most of my files are too large to be handled by the demo.)
This did at least prove that the required files (keys) did exist
somewhere on my system.

However my question was asking for a step by step guide as opposed to
a £60 ($100) piece of software. Thanks to livioflores-ga and atomek-ga
for finding  http://www.elcomsoft.com/aefsdr.html software though, I
will use this if no other alternative is found. I do accept that this
does answer the question in part because it does provide /a/ solution.

Thanks to livioflores-ga for this link
http://www.beginningtoseethelight.org/efsrecovery/index.php
I'll try this guide out in the coming days. I'll post back my findings
and pay livioflores-ga for this as the accepted answer if it works.

Best Regards
mrmr96-ga

---

Clarification of Question by mrmr96-ga on 06 Jan 2006 01:54 PST

Hello,

As livioflores-ga answered my original question by providing a link to
a step by step guide I'm asking him/her to post this as the answer
which I will accept and pay for.

NOTE - Unfortunatly I was unable to follow the guide (so I bought the
AEFSDR software, and it worked) but livioflores-ga did provide the
answer to the question that I asked - which is why I'm accepting the
answer.

Cheers

Hi!!

Thank you for giving me the opportunity to answer your question, I
appreciate that. I am also so glad to know that you have found a
solution for your problem.

Now I will repost my comment here to make it the official answer.

isit the following pages for step by step instructions:
"TweakXP.com - De-crypt Encrypted files on Windows XP":
http://www.tweakxp.com/article37355.aspx

or may be this one do the trick (it sounds more advanced):
"encrypted file system recovery":
http://www.beginningtoseethelight.org/efsrecovery/index.php

The following program claims to recover the encrypted files, you can
try with the trial version:
"ELCOMSOFT: Advanced EFS Data Recovery":
Advanced EFS Data Recovery (or AEFSDR) is a program to recover
(decrypt) files encrypted on NTFS (EFS) partitions created in Windows
2000, Windows XP and Windows Server 2003.
http://www.elcomsoft.com/aefsdr.html


For additional reference see:
"Encrypting File System in Windows XP and Windows Server 2003":
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/cryptfs.mspx

See also this chapter at Microsoft's support site for better understanding:
"Ch 17 Encrypting File System":
http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-us/prnb_efs_qutx.asp


Best regards, 
livioflores-ga

The researcher answered my question by providing a link to a guide to
decrypt EFS files. They were also kind enough to provide the answer as
a comment first, allowing me to check it's what I wanted before
accepting it as the final answer.
Thanks a lot!

Your files are EFS encrypted. The easiest solution would be to buy
Advanced EFS Data Recovery from Elcomsoft.
http://www.elcomsoft.com/aefsdr.html

Just give it a try. Should be easy to use!
Best Regards!
Andi