Windows XP- Encrypted files EFS

[Real_Jose_Pinto]

does anyone know how to remove EFS in XP? I have JPG files which are being encrypted using EFS in XP home.

Those files stored in previous motherboard which were blown off, i tried putting the drive in different motherboard but the windows won't boot up, keeps restarting. R-studio can see these files but can't open the JPG due to encrypted files.

These files turned green (encrypted) , normal color is black.

Although Admin password as been removed.

Thank's

[Steve]

there is a registry fix that will allow you to boot the old hard drive on the new motherboard , ( but you have to have access to the registry , I use winterals ERD)
here is the info from Microsoft
http://support.microsoft.com/kb/314082

[spideroo7]

hi there can you play cd s on your comp after upgrade?

[spideroo7]

hi there can you play cd s on your comp after upgrade?

[Real_Jose_Pinto]

yes, i could boot from cd but can't access documents and settings folder, access denied


steve, tried that no luck

[Steve]

there is a registry setting that will stop the reboot , so you can see the error message( and thus fix windows where it will work on the new motherboard)

HKEY_LOCAL_MACHINE SYSTEM ControlSet001 Control CrashControl AutoReboot .. Change to 0(zero)

HKEY_LOCAL_MACHINE SYSTEM ControlSet002 Control CrashControl AutoReboot .. Change to 0(zero)

HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control CrashControl AutoReboot .. Change to 0(zero)

after this change reboot and the computer will stop on the blue screen and you can retrieve the error message

All this change does is prevent auto-reboot after a crash

[Steve]

if you don't have ERD . or avast Bart .. Knoppix Live CD May allow access to the registry ( you didn't say if you gained access to registry)

[Real_Jose_Pinto]

thank you steve..i'll give it a go tomorrow

[DjLizard]

I believe that if you import the certificates you may be able to decrypt the files.

If you are able to find "Documents and Settings\Username\Application Data\Microsoft\Crypto\RSA" and "Documents and Settings\Username\Application Data\Microsoft\SystemCertificates\My\Certificates" somewhere on the drive (edit: of the old installation) then you can import them, and I believe this is how you do it:
1) open Internet Explorer
2) Tools > Internet Options
3) Content tab > Certificates button
4) Import button

I've never actually had to use this so I wouldn't be surprised if the above was wrong (but good luck though )

There are some Microsoft knowledge base articles about recovering EFS - you might want to search for them.

[TerraNova]

Hi Jose

I have excactly same problem after old motherboard burnt reinstall Windows and cannot access files because encrypted using EFS.

Anyone tried and success?

I tried http://www.easeus.com/datarecoverywizar ... d-data.htm no luck.

[rchadwick]

I know it's not the 'fun' way to recover the files (Brute Force decrypting, etc), but if you fix the registry (Mentioned above) so that it will boot from another Motherboard without a BSOD, you should be OK. Try looking at http://www.ubcd4win.com. It's a Bootable Windows XP Environment, and there's even a tool in there that will automatically make the needed registry change.

[TerraNova]

thanks rchadwick will try

[zed]

I have used this program to copy EFS encrypted files into a non-EFS format. It's ideal to recover the data from a EFS encrypted drive.

http://elcomsoft.com/aefsdr.html

[Shortscurcuits]

Hi just do repair install to get rid of bsod on bootup. You need CD key and choose install windows XP from boot disk then hit r for repair and you can keep everything. (you still need password for encrypted files).