ChunkDog Posted December 3, 2004 Share Posted December 3, 2004 Nothings imposible, always remember that!http://www.crackpassword.com/products/prs/mswin/efs/is your data worth $100?this site might help also: http://www.ntfs.com/issues-encrypted-files.htm Link to comment Share on other sites More sharing options...
Vietfobster Posted December 3, 2004 Author Share Posted December 3, 2004 chunkdog, how do u give urself permission on bartpe? i ran it but dont know where to go.i disabled "simple file sharing and now theres a "security" tab on the file properties. i try to take ownership but still, i cant access the files. i still cant decrypt them. Link to comment Share on other sites More sharing options...
ChunkDog Posted December 3, 2004 Share Posted December 3, 2004 Did you use the XPE plugin? If so, it should be just like Windows XP if it was installed on a systems hard drive, but with some bugs and limitations here and there. Just go to the files that are encrypted, and change their security settings to allow everyone access to them. Then try to decrypt them in Windows XP normally. I really dont know if this will help, and you might want to look into the program I posted in my last post. If you give me your E-mail I'll send you a program that might help. Link to comment Share on other sites More sharing options...
Vietfobster Posted December 3, 2004 Author Share Posted December 3, 2004 ok i just tried advanced efs data recovery and its a no go. the files are "not decryptable". also, the xpe plugin site doesnt work ok chunkdog, can u send me the xpe plugin? ill pm u with my email address. thanks for helping! Link to comment Share on other sites More sharing options...
ChunkDog Posted December 4, 2004 Share Posted December 4, 2004 Temporary file is not erased. When EFS encrypts file, it copies its contents into temporary hidden file named Efs0.tmp in the same folder, as encrypting file. Then, it encrypts plain text by blocks and writes encrypted data into original file. After the process is done, temporary file is deleted. The problem is that EFS simply marks it as deleted without actually erasing its contents, which makes possible easy access to unprotected data by low-level data recovery software like Active@ Undelete. Solution - to wipe free disk space. Usually, even if plain text overwritten ones, small magnetic traces remain detectible, thus giving a chance to read erased data with proper equipment. To minimize this possibility, use commercially available software providing sophisticated data erasing algorithms like Active@ Eraser or ZDelete.NET.here is what I wanted you to see on the website I had linked to in a previous post. Basically you could use a data recovery program to get the Efs0.tmp files back that contain an un-encrypted version of your file, IE the original file. You might not get everything back with this method, but I assure you that you will get a good majority of your data back, but make sure you specify your main boot partition to put the recovered data to, or another hard drive entirely. As for a data recovery program, I would sudgest either "GetDataBack" or Ontrack's "Easy Recovery Pro". Both of those programs will do a great job. I have found getdataback to be the best IMO, but Easy Recovery Pro is alot easier.P.S.I have sent you a program to try and also the XPE 0.9.9 plugin for PE Builder, just unrar it and put the whole xpe 0.9.9 directory in your plugins directory for PE Builder. Link to comment Share on other sites More sharing options...
Vietfobster Posted December 4, 2004 Author Share Posted December 4, 2004 thanks chunkdog! im gonna check my email rite after this reply.getbackdata and easyrecoverypro seem like great products but i dunno if it can decrypt a file that doesnt have the rite certificate on the computer. i tried the "ownership" thingy with "simple file sharing" disabled and messing around with the "security" but still no luck. so i dunno if the programs will really work.ok time to work with xpe plugin! THANKS ALOT CHUNKDOG. lets just hope it works Link to comment Share on other sites More sharing options...
Ge0ph Posted December 4, 2004 Share Posted December 4, 2004 Sorry, army20 is correct, say goodby to your files. Link to comment Share on other sites More sharing options...
Vietfobster Posted December 4, 2004 Author Share Posted December 4, 2004 **sighs** i booted into bart xpe and did everything i could. in the end, it was a no go. oh well i guess ill just have to get my lost data all over again thanks for helping everyone.EDIT: and ge0ph, i dont have to say goodbye to my files. i can get them off the net all over again. theyre not rare phew! lol Link to comment Share on other sites More sharing options...
Alanoll Posted December 4, 2004 Share Posted December 4, 2004 just as long as it's not illegal.... Link to comment Share on other sites More sharing options...
Vietfobster Posted December 4, 2004 Author Share Posted December 4, 2004 just as long as it's not illegal....lol Link to comment Share on other sites More sharing options...
army20 Posted December 4, 2004 Share Posted December 4, 2004 what about government agency, are they able to decrypt EFS files ? Link to comment Share on other sites More sharing options...
Vietfobster Posted December 4, 2004 Author Share Posted December 4, 2004 just when i felt it was over for my data, army20 pops up and gives me a lil bit of hope yea like he asked, are they able to decrypt if they were in my situation? Link to comment Share on other sites More sharing options...
Alanoll Posted December 4, 2004 Share Posted December 4, 2004 If it's using RSA encryptiong (most likely) it can be decrypted. However, the problem is time and raw processing speed. If the government needed the data....say espionage....or something, they may spend the time, otherwise....depending on the system, and how long the encryption keys are, it can take upwards of 6 months to decrypt the files. Link to comment Share on other sites More sharing options...
Vietfobster Posted December 4, 2004 Author Share Posted December 4, 2004 dayummm!!!!! 6 months? Link to comment Share on other sites More sharing options...
Alanoll Posted December 4, 2004 Share Posted December 4, 2004 that's I believe two desktop PCs working together uninterrupted. Mainframes and such would knock it down significantly. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now