Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Encryption problems after reboot...


  • Please log in to reply
1 reply to this topic

#1 Zharkanoid

Zharkanoid

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:16 PM

Posted 19 June 2014 - 06:38 AM

Hi all.  New member so hope I post correctly.  Firstly, I'm so pleased to have found this site.  It looks like a great bunch of knowledgeable people have come together to offer superb advice so I hope to make use of this 'collective' myself!  I did have a search for any similar problems to mine but after a while I gave up and decided to throw this out there and see if anyone can offer advice on my next move...

 

 

OS: Windows XP PRO SP3

 

 

So, after a completely random bootup (before Windows loaded) the diskscanner (chkdsk) program ran out of the blue - apparently found a few errors - deleted a load of stuff and continued to load normally.  Now; it would seem; my EFS key is corrupt (an assumption) as all the files in a single, encrypted folder I have are inaccessible.  I get the "Access is denied" popup on all files I try and open within the folder.  I have no idea what was deleted either as it was on the screen and gone BEFORE I could read it!  Why they don't pause and let you "Press any key to continue" is beyond me...

Anyway.  My first mistake was not to back up the EFS decryption key or assign a recovery agent.  Never even considered that you'd have to.  Now, according to 'unpoupular' belief, if that's the case then it's game over.  However, 'Googling' reveals that there maybe other possible options.  I do have normal 'system' backups and registry backups prior to this hiccup but I'm damned if I can find out if they actually contains anything useful (i.e. registry/EFS info) to make use of.  I've tried (just in case) a system restore to before the 'incident' but that did nothing.  The restore point on the day of the issue is 'restorable' to but no point prior to that date will work so I guess they are also corrupt.  As a desperate idea, I tried restoring an old registry backup but that did nothing either.  I've since found out that restoring the registry 'directly' only adds keys - not replaces/changes keys.  I've also checked the harddisk again for any errors but it comes back apparently clean as a whistle.

I did consider trying EaseUS Data Recovery 'Free' but I don't really know how that works.  There are people who have had success with it but; upon reading the blurb; it says you can't install it on the HDD you are trying to recover files from!?!?!  Anyone got any experience with it?  I've never had much to do with encryption really.  Not my field at all.  It was just a single folder I toyed with one day and then 'forgot' all about it.  From time to time, I'd put a document (or two!) in it but nothing major.  It would just be nice to retrieve them if at all possible.

As to the root cause - the only thing I've done recently (prior to the issue) is a routine AV scan and 'defrag' of the HDD.  I never thought that defragging would wreck the file system though, would it?  Apart from that, I've installed no new programs or done any major updates other than anti-virus software definition updates and an Adobe Flash update.  So, anything else I can try?  Perhaps there's a magic bit of software you know of or a method to break (or circumvent) the encryption?  Can I make use of my old registry backups at all?  If anyone has a good suggestion then I'd love to hear from you.  Oh, and before anyone wonders, I have checked thoroughly for virus or malware since - all clean and good thankfully!

Best regards,

 

Zharkanoid.



BC AdBot (Login to Remove)

 


#2 JohnC_21

JohnC_21

  • Members
  • 24,442 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:16 AM

Posted 19 June 2014 - 08:59 AM

I think the best chance you have is to recover the files is with a program like this. You can download the demo to see if you can access the encrypted files.

 

http://www.diskinternals.com/efs-recovery/


Edited by JohnC_21, 19 June 2014 - 09:00 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users