Member Avatar for vikas_ry

Hi Friends,

I am vikas from india , i have just now joined the community and i am very happy to find all technical gurus in the community , i am pursuing engneering in electronics and communication (4 year cource).
i have some problem and i hope here i will get the solution of problem definitely.

i am using sony vaio laptop which came installed with a Fingerprint
sensor and pre-installed windows vista business.
basically, i am facing Decryption problem.
actually, i encrypted some of my files using fingerprint but i didnt
provided any backup password for decryption. so only swiping the
correct finger on fingerprint sensor could unlock or decrypt those files .but
it can not be unlocked using any password bcoz i didnt provide it at
the time of encryption .i just encrypted files using my fingerprint using biometric reader.
now what mistake i did actually ... i formatted and wiped out my HDD completely and i
reinstalled win vista business , and before formatting i forget to
decrypt those files. now ,all the fingerprint data , keys and certificates
are lost due to formatting and wiping HDD and i dont have backup of any keys or
certificates.
and now i m unable to decrypt those files and a msg is displayed always
"unauthorised user" if i try to open the files.

actually, initially during encryption if i would have also provided a backup password with
fingerprint , then i would certainly have the ability
to decrypt the files in case of fingerprint data loss or
keys/certificates loss what have exactly happened due to formatting.
i have tried a software named as " Elomsoft Advanced EFS data
recovery " for decryption of files but it didnt solve any of my purpose and it
was not able to decrypt any file.

now can you please guide me , what should i do actually to
decrypt those files in win vista again . i greatly need your help . if
you can please let me know the steps to recover the files i would
greatly be hounoured by your help.

Thanks a lot
VIKAS

  • 4 Contributors
  • 3 Replies
  • 218 Views
  • 3 Years Discussion Span
  • Latest Post Latest Post by Maniapidoulou

Dani AI

Generated

Short, focused summary and practical next steps rooted in how EFS actually works

As described, the symptom (“unauthorised user” after a full format) is exactly what you get when the Windows EFS private key is lost: EFS encrypts each file with a per-file symmetric key (FEK) and that FEK is itself encrypted with the user’s certificate/private key — without that private key (or a configured Data Recovery Agent) the FEK cannot be recovered and the files stay unreadable. (learn.microsoft.com)

Where to look and what to do first (do not keep using the drive)

  • EFS certificates and private-key containers live in the user profile (for example under %APPDATA%\Microsoft\SystemCertificates and %APPDATA%\Microsoft\Crypto\RSA or %APPDATA%\Microsoft\Crypto\Keys). DPAPI master-key files are stored under the Protect folder for the user SID. If those files survived on the old disk you can restore/import them; if they were removed/overwritten, recovery is effectively impossible without a DRA. (learn.microsoft.com)
  • Immediately stop writing to that disk. Make a bit-for-bit image (use a forensic workflow/write blocker) and work from the image — that preserves any leftover key files. NIST guidance covers this best practice. (csrc.nist.gov)

Quick checks and commands to try on an image or backup

  • Search the image for exported certificate files (.pfx / .p12) or the old user profile tree (Windows.old).
  • To list a user’s personal certificates from a working Windows environment use certutil; if you find a .pfx you can import it. Example commands (run against the recovered image or on a safe analysis machine): 
certutil -user -store My
certutil -f -user -importpfx C:\recovered\mykey.pfx

Refer to the certutil documentation before running these. (learn.microsoft.com)

Realistic expectations

  • Built-in tools or forensic suites can only help if the original certificate/private-key material still exists on the disk; they cannot “crack” EFS encryption if the keys are gone. Forensic/data-recovery labs sometimes succeed when key files are in unallocated sectors and not yet overwritten, but success is not guaranteed and can be expensive. If no exported .pfx, no system-image backup, and no DRA existed, the encrypted files are effectively unrecoverable. (learn.microsoft.com)

Notes tied to earlier replies

  • As suggested, Windows tools can show which certificate was used, but those tools only help when the private key still exists. As and noted, a forensic approach is the only remaining path when keys were lost — and it only works if key material survived the format.

Recommended Answers

All 3 Replies

Member Avatar for chris5126

why have you posted this twice i have give you probably the only answer to the question which is you need to hack the files using a program like forensic tool kit (ftk) or another similar program that will be the only way as you have no way of recovering the keys.

P.S. if you keep posting the same problem it wont mean you will get more replies it will mean more people will ignore you and you will get kicked off and your posts deleted.

Member Avatar for Comodore

First of all, welcome, and good to have you!

I didn't see your first question, so I'll pretend this is it.

You can try opening a command prompt Start>run>cmd and use the cipher command on the files. This will help you:

http://www.computerhope.com/cipher.htm

I'm not sure if it will help with the fingerprinting- I don't know how that works- but its worth a shot.

Get back to us!

All the best,

--The Comodore

Member Avatar for Maniapidoulou

I'd really need some help too. Can someone explain me how cipher works? I went to the website but it still is hard to understand.

I'm currently downloading FTK I hope it's going to work. To you know some places where I can find a good tutorial about that software?

Thank you very much, I really want to open these documents. After the crash of my PC because of a virus I was able to save all my files via Ubuntu but now my fingerprints encrypted files no longer recognise me as an authorised used...

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.