EFS Security in Vista - trying to recover EFS certificate

[baby1212]

I saw on the main (?) website ( http://www.geocities.com/babarnazmi/ ) about breaking EFS security in 2000-XP and above. I\'m wondering if you have a solution for doing this in Vista and if so how?

The OS is corrupted (or at least won\'t boot) and so I can\'t boot up the HD in the traditional sense. But all the tests I have done on the drive seems to show all the files as good and intact and no issues with anything so I\'m hoping I can pull the EFS certificate to put into a new install so I can access one file that is locked in EFS.

Any direction or help is much appreciated! Thank you!

[Babar Shafiq Nazmi]

Its the same on XP/2000 and higher, you need to have the backup of your old registry which will be available in "Documents and Settings" and then the particular user who encrypted those files for example:-
If user is Administrator then path will be
windows root directory/Documents and Settings/Administrator

Let me know if you still have access to files in that folder

Kind Regards,
Babar Shafiq Nazmi

[baby1212]

Yes I do have access to the folder... was trying to figure out where/what files to retrieve/recover/backup the registry on the drive... what should I be looking for?

[baby1212]

What I\'m slightly confused about is the fact that Documents and Settings doesn\'t exist in Vista anymore so I was trying to find that comparable too. Would we be talking about E:Users{UserName} ? And more specifically the NTUSER.DAT file located there?

[Babar Shafiq Nazmi]

Yes you need ntuser.dat file, its your old registry were you might have EFS key still available...

Kind Regards,

[baby1212]

Ok, the question is now, what do I do with the ntuser.dat file? How do I export the EFS keys from the old registry?

[Babar Shafiq Nazmi]

Just this:

Start|Run|Regedit
Click on HKEY_Users
File|Load Hive
Give it a name like "User"
Do what you want to it.
File|Unload Hive


And Find EFS key in that raw registry, there are some tools also available for doing the same

[baby1212]

Super! Got that far...

And Find EFS key in that raw registry, there are some tools also available for doing the same

Where I\'m still stuck at is actually getting the EFS keys from that registry or somehow being able to use those keys to open an encrypted file... do I just load the hive and restart the computer? Or?

[Babar Shafiq Nazmi]

Copy that key and paste in the new registry where you want it to open, Also export EFS certificate this time

[baby1212]

Ok, super! I got it! Thank you so much for your help!

[Babar Shafiq Nazmi]

Most Welcome...