Need to recover encrypted files from Windows XP drive

I had a problem with an older Windows XP Pro machine. I now have a Windows
Vista Premier x64 machine. Since the old computer had an ATA drive I couldn't
just move the old hard drive to the new SATA system so I have bought an
external hard drive kit to connect the old drive to the new system via a USB
2.0 port.

My problems is that I can no longer access some encrypted files on the old
hard drive. I would appreciate help figuring out how to recover the old
files.

You need to decrypt the files by importing in your old EFS encryption
certificate (which you should have exported on the old XP Pro machine).
Alternatively, if the XP machine was in a domain, the EFS recovery agent for
the domain's certificate and private key can be used to recover the EFS
files.
You can view the thumbprints of the certificates by viewing the properties
of the affected files on the General tab, by clicking the Advanced button.
You must have both the certificate with the matching thumbprint and access
to the private key.

Brian

"owlfan12000" <owlfan12000@discussions.microsoft.com> wrote in message
news:80DECE01-5CC4-4EC5-969F-2FB7C752B24B@microsoft.com...
>I had a problem with an older Windows XP Pro machine. I now have a Windows
> Vista Premier x64 machine. Since the old computer had an ATA drive I
> couldn't
> just move the old hard drive to the new SATA system so I have bought an
> external hard drive kit to connect the old drive to the new system via a
> USB
> 2.0 port.
>
> My problems is that I can no longer access some encrypted files on the old
> hard drive. I would appreciate help figuring out how to recover the old
> files.

Brian,

Thanks for your help. I've got a few questions/comments:

1. "You need to decrypt the files by importing in your old EFS encryption
(which you should have exported on the old XP Pro machine)." The old machine
crashed so I did not export anything. Is there a knowledge base article or
something that describes how to import the old EFS encryption now? Is it even
possible?

2. I'm not sure whether my old machine was set up as a domain or not. I did
have multiple users set up with XP Pro.

3. I can't view any encryption info from the advanced button of a file. The
encryption box is checked but it is grayed out.

4. Some additional history in case it is relevant. The files in question are
in a folder that was copied from an even earlier computer hard drive that may
have been running Windows 98. In the XP machine I installed the old drive as
a slave and copied the folder over to a new directory on the XP machine. I
still have the original drive from the Windows 98 machine. New files were
later added to the directory.

5. FYI, My first computer was a Zenith 8088 with a 10 MB hard drive so I
know my way around directories and can find my way around the registry if
necessary. That being said I've become less educated about the operating
systems as Microsoft has moved to XP and I'm still very frustrated finding
anything in Vista. (All of that means I also know enough to be dangerous.)

John

"Brian Komar (MVP)" wrote:

> You need to decrypt the files by importing in your old EFS encryption
> certificate (which you should have exported on the old XP Pro machine).
> Alternatively, if the XP machine was in a domain, the EFS recovery agent for
> the domain's certificate and private key can be used to recover the EFS
> files.
> You can view the thumbprints of the certificates by viewing the properties
> of the affected files on the General tab, by clicking the Advanced button.
> You must have both the certificate with the matching thumbprint and access
> to the private key.
>
> Brian
>
> "owlfan12000" <owlfan12000@discussions.microsoft.com> wrote in message
> news:80DECE01-5CC4-4EC5-969F-2FB7C752B24B@microsoft.com...
> >I had a problem with an older Windows XP Pro machine. I now have a Windows
> > Vista Premier x64 machine. Since the old computer had an ATA drive I
> > couldn't
> > just move the old hard drive to the new SATA system so I have bought an
> > external hard drive kit to connect the old drive to the new system via a
> > USB
> > 2.0 port.
> >
> > My problems is that I can no longer access some encrypted files on the old
> > hard drive. I would appreciate help figuring out how to recover the old
> > files.
>
>

On Tue, 22 Apr 2008 07:13:01 -0700, owlfan12000 wrote:

> Thanks for your help. I've got a few questions/comments:
>
> 1. "You need to decrypt the files by importing in your old EFS encryption
> (which you should have exported on the old XP Pro machine)." The old machine
> crashed so I did not export anything. Is there a knowledge base article or
> something that describes how to import the old EFS encryption now? Is it even
> possible?

If you used EFS encryption on these files and had not exported the EFS
certificate and private key and don't have a valid backup of the system
from before it crashed then your files are gone for good.

--
Paul Adare
http://www.identit.ca
There are two ways to write error-free programs; only the third one
works.

owlfan12000 wrote:
> I had a problem with an older Windows XP Pro machine. I now have a Windows
> Vista Premier x64 machine. Since the old computer had an ATA drive I couldn't
> just move the old hard drive to the new SATA system so I have bought an
> external hard drive kit to connect the old drive to the new system via a USB
> 2.0 port.
>
> My problems is that I can no longer access some encrypted files on the old
> hard drive. I would appreciate help figuring out how to recover the old
> files.

This isn't trivial.

You need to create an account with the same username, password, user
number and machine sid as the original account, copy Crypto, Protect and
SystemCertificates directories from
X:\Docs&Settings\Username\Application Data\Microsoft\ to your machine
and log in as that user.

Alun Harford;693302 Wrote:
> owlfan12000 wrote:> > >
> > This isn't trivial.
> >
> > You need to create an account with the same username, password, user
> > number and machine sid as the original account, copy Crypto, Protect
> > and
> > SystemCertificates directories from
> > X:\Docs&Settings\Username\Application Data\Microsoft\ to your machine
> > and log in as that user.> >
>
> Hi Alun,
>
> I was wondering, I am having a similar issue and wanted to do as you
> suggest. However, I am following you as far as creating the same user
> number and machine SID.
>
> How does one do that when creating a new account (with the same
> username, password, user number and machine SID as you suggest)?
>
> To let you know, I have two hard drives installed in my machine; one
> has a damaged OS (this is the one holding the encrypted data I can't
> access) and the other HD has a working one. The latter is the one I
> hope to create a new account in, and use that to access the encrypted
> files. I do have access to the old keys in the old HD.
>
> Thanks!


--
Temujin

[bettyharven]

Quote:

Originally Posted by owlfan12000

I had a problem with an older Windows XP Pro machine. I now have a Windows
Vista Premier x64 machine. Since the old computer had an ATA drive I couldn't
just move the old hard drive to the new SATA system so I have bought an
external hard drive kit to connect the old drive to the new system via a USB
2.0 port.

My problems is that I can no longer access some encrypted files on the old
hard drive. I would appreciate help figuring out how to recover the old
files from hard drive.

Remember that the best way to recover data from a failed hard drive is by doing preventative measures. Always back up your files. Do this even if you just started using your computer. This will save you time should your computer dies on you.