Author Topic: EFS Security in Vista - trying to recover EFS certificate  (Read 12054 times)

Offline baby1212

  • Junior Member
  • **
  • Posts: 6
  • Karma: +0/-0
    • View Profile
EFS Security in Vista - trying to recover EFS certificate
« on: April 30, 2009, 09:48:27 PM »
I saw on the main (?) website ( http://www.geocities.com/babarnazmi/ ) about breaking EFS security in 2000-XP and above. I\'m wondering if you have a solution for doing this in Vista and if so how?

The OS is corrupted (or at least won\'t boot) and so I can\'t boot up the HD in the traditional sense. But all the tests I have done on the drive seems to show all the files as good and intact and no issues with anything so I\'m hoping I can pull the EFS certificate to put into a new install so I can access one file that is locked in EFS.

Any direction or help is much appreciated! :) Thank you!

Offline Babar Shafiq Nazmi

  • Administrator
  • Senior Member
  • *****
  • Posts: 153
  • Karma: +87/-0
    • View Profile
    • Silicon Technix
Re: EFS Security in Vista - trying to recover EFS certificate
« Reply #1 on: April 30, 2009, 10:18:40 PM »
Its the same on XP/2000 and higher, you need to have the backup of your old registry which will be available in "Documents and Settings" and then the particular user who encrypted those files for example:-
If user is Administrator then path will be
windows root directory/Documents and Settings/Administrator

Let me know if you still have access to files in that folder

Kind Regards,
Babar Shafiq Nazmi
....God is the greatest Programmer....

http://www.silicontechnix.com

Offline baby1212

  • Junior Member
  • **
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Re: EFS Security in Vista - trying to recover EFS certificate
« Reply #2 on: April 30, 2009, 11:17:02 PM »
Yes I do have access to the folder... was trying to figure out where/what files to retrieve/recover/backup the registry on the drive... what should I be looking for?

Offline baby1212

  • Junior Member
  • **
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Re: EFS Security in Vista - trying to recover EFS certificate
« Reply #3 on: April 30, 2009, 11:29:48 PM »
What I\'m slightly confused about is the fact that Documents and Settings doesn\'t exist in Vista anymore so I was trying to find that comparable too. Would we be talking about E:Users{UserName} ? And more specifically the NTUSER.DAT file located there?

Offline Babar Shafiq Nazmi

  • Administrator
  • Senior Member
  • *****
  • Posts: 153
  • Karma: +87/-0
    • View Profile
    • Silicon Technix
Re: EFS Security in Vista - trying to recover EFS certificate
« Reply #4 on: May 02, 2009, 02:31:20 AM »
Yes you need ntuser.dat file, its your old registry were you might have EFS key still available...

Kind Regards,
....God is the greatest Programmer....

http://www.silicontechnix.com

Offline baby1212

  • Junior Member
  • **
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Re: EFS Security in Vista - trying to recover EFS certificate
« Reply #5 on: May 02, 2009, 10:28:51 PM »
Ok, the question is now, what do I do with the ntuser.dat file? How do I export the EFS keys from the old registry?

Offline Babar Shafiq Nazmi

  • Administrator
  • Senior Member
  • *****
  • Posts: 153
  • Karma: +87/-0
    • View Profile
    • Silicon Technix
Re: EFS Security in Vista - trying to recover EFS certificate
« Reply #6 on: May 02, 2009, 10:58:36 PM »
Just this:

Start|Run|Regedit
Click on HKEY_Users
File|Load Hive
Give it a name like "User"
Do what you want to it.
File|Unload Hive


And Find EFS key in that raw registry, there are some tools also available for doing the same
....God is the greatest Programmer....

http://www.silicontechnix.com

Offline baby1212

  • Junior Member
  • **
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Re: EFS Security in Vista - trying to recover EFS certificate
« Reply #7 on: May 02, 2009, 11:31:03 PM »
Super! Got that far...

Quote from: \"babar\"
And Find EFS key in that raw registry, there are some tools also available for doing the same

Where I\'m still stuck at is actually getting the EFS keys from that registry or somehow being able to use those keys to open an encrypted file... do I just load the hive and restart the computer? Or?

Offline Babar Shafiq Nazmi

  • Administrator
  • Senior Member
  • *****
  • Posts: 153
  • Karma: +87/-0
    • View Profile
    • Silicon Technix
Re: EFS Security in Vista - trying to recover EFS certificate
« Reply #8 on: May 03, 2009, 12:14:44 AM »
Copy that key and paste in the new registry where you want it to open, Also export EFS certificate this time :)
....God is the greatest Programmer....

http://www.silicontechnix.com

Offline baby1212

  • Junior Member
  • **
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Re: EFS Security in Vista - trying to recover EFS certificate
« Reply #9 on: May 04, 2009, 08:47:51 PM »
Ok, super! I got it! :D Thank you so much for your help!

Offline Babar Shafiq Nazmi

  • Administrator
  • Senior Member
  • *****
  • Posts: 153
  • Karma: +87/-0
    • View Profile
    • Silicon Technix
Re: EFS Security in Vista - trying to recover EFS certificate
« Reply #10 on: May 04, 2009, 09:58:16 PM »
Most Welcome...
....God is the greatest Programmer....

http://www.silicontechnix.com