Big encryption problem

Hello everybody

I've got a big problem regarding windows encryption. Heres the deal-

I have 2 hard drives. One for files, one for the Windows xp operating system and software. Just recently, I formatted the xp pro operating system and installed XP pro with a new XP cd. (XP PRO) I just realized that I don't have access to some of the files on my second hard drive. I have a huge bibliography on that drive, which I need for a research paper.

So my question-

I'm using the same username and password on this new installation. I own this computer, I have full privledges, I am using legit CD's, and I know my passwords. I get the attached error when I try to open the word document. I need to know how to give myself privledges to my own files. I am looking at ways, but they seem to need a certificate from the old XP install, which is now formatted. I know the username, and password of the old accounts, because it's mine. Is there some way I can open this file???

Thanks in advance! :D


Just tried a boot disc, it maintained the encryption.

Here is that window about the certificate, Is there anyway I can create that certificate and use that? I know its password, I just have no clue how to create one. (Or if this will even work)

:(

Hi Soda, you nasty little social engineering Troll :D

I am afraid it has just gotten to that day once every year when I don't care too much. Check my profile if you do not understand.........

I will give it a go, but only when sober (like not right now :) )

Tell me ,what version of office is it? and is it an NTFS or FAT 32 file

Cheers

Johnno

Quote:

---

Originally posted here by nihil
Hi Soda, you nasty little social engineering Troll :D

---

:p

Word 2002, NTFS.


Thanks a bunch!


edit-

I just realized that a section of the paper this bibliography is for is on encryption. That just hurts... :(

You didn't turn on EFS for those files/folders by any chance, did you? :p

After doing some searching I found these two links, I think they are what you are looking for.

http://support.microsoft.com/default...308989&sd=tech
http://support.microsoft.com/default...b;EN-US;308993

Hope this helps.

Basically what you need to do is take permission over all the old files. What has happened is the old OS applied SID's (Security Identifiers) and the new install will generate different SID's despite the same names and passwords, so to fix this navigate to the other hard drive, right click the file, go to Sharing and Security should be an advanced option or a security button, what you need to do is click on the that and it should bring you to a permissions area, you will have to take permission of all the folders and subfolders and add your new login/administrator name to them. If you need let me know and Ill take some screen shots to better show you

edit: unless of course you did turn on efs ;)

Wouldn't that defeat the entire point of EFS? EFS-encrypted files can only by accessed by users with the right permissions. If you could just add permitted users, what's the use?

The problem is that he doesn't have the correct permission, and that he's got no back-ups of the key...?

Well he hadnt specified if he actually used something like EFS or another encryption program, other than I suppose the title of the thread and the error message looks strangely like one I have seen on my old computer when I had permissions setup so I figured I would cover that base before we dug too deep into it...after I posted and read your post I remembered I wasnt even considering efs
but anything is worth a try

It would help if Soda would wake up and tell us :D
Would changing his Windows key (which can be easily done... if his Windows copy is legal, he should have a key) back to the original one help to get around EFS?

Spyrus, I couln't find the window you spoke of. But, I found Advanced EFS Data recovery here:
http://www.elcomsoft.com/aefsdr.html

I found out I am kinda lucky, because I was experimenting with cain and able and lc a while ago, so I have my SAM saved on my usb key. But it needs the private key. I think I am out of luck because I am guessing it generates the private key. It searched for files encrypted with EFS and found them, although I don't remember turning it on. Looks like I'm screwed unless I can somehow use my SAM. Anyways, thanks for your help everyone.

Neg- I am totally 100% legal and legit here, I have a educational copy and a giveaway copy from work (lucky me).

From microsoft knowledge base:


Members of the Administrators group cannot decrypt files unless the person who encrypted the files designated them as recovery agents before encrypting the files.

NOTE: You must be the original encrypter of the file or a designated recovery agent for the file to use the following steps. If you are not authorized to remove encryption, you receive the following error message:

Error Applying Attributes
An error occurred applying attributes to the file:

Path:\Filename

Access is denied
To remove encryption from a file:
Use Windows Explorer to browse to the location of the encrypted file that you want to decrypt.
Right-click the encrypted file, and then click Properties.
On the General tab, click Advanced.
Click to clear the Encrypt contents to secure data check box, click OK, and then click OK again.
back to the top
How to Remove Encryption from a Folder
NOTE: You must be the original encrypter of the file or a designated recovery agent for the file to use the following steps. If you are not authorized to remove encryption, you receive the following error message:

Error Applying Attributes
An error occurred applying attributes to the file:

Path:\Filename

Access is denied
Use Windows Explorer to browse to the location of the encrypted folder that you want to decrypt.
Right-click the folder, and then click Properties.
On the General tab, click Advanced.
Click to clear the Encrypt contents to secure data check box, click OK, and then click OK again.
When you are prompted to confirm the attribute change:
If you want to decrypt only the folder, click Apply the changes to this folder only, and then click OK.
If you want to decrypt the folder and its contents, click Apply changes to this folder, subfolders and files, and then click OK.
------------------------------------------------------------------------------------------------------------------------
Also:
Recovering Access to Encrypted EFS Data
If you have encrypted some of your files by using the Encrypting File System (EFS), you have additional options to recover access to those encrypted files. The following provisions apply only to EFS encrypted files, and will not recover access to saved credentials or certificates.

If you have previously exported the user's EFS private key from the user's account, you may import the key back into the account and recover access to the encrypted files.

If you did not export the private key and you have defined a Data Recovery Agent (DRA) prior to encrypting the files, you may regain access to EFS files as the Data Recovery Agent. For additional information about how to recover data in this case, click the article number below to view the article in the Microsoft Knowledge Base:
255742 Methods for Recovering Encrypted Data Files

If you do not have the required items or information specified for the preceding recovery solutions, the data is permanently encrypted, and cannot be recovered.
STATUS
This behavior is by design.
MORE INFORMATION
The behavior that is described in this article is a security measure taken to protect the security of the user's private information. A malicious administrator that can reset a user's password and thereby gain access to the user's account cannot access encrypted files or authentication materials without the user's knowledge or permissions.

Before being allowed to reset a password, an administrator or owner of the computer is prompted with the following messages:

Resetting this password might cause irreversible loss of information for this user account. For security reasons, Windows protects certain information by making it impossible to access if the users password is reset.

The data loss will occur the next time the user logs off.

You should use this command only if a user has forgotten his or her password and does not have a password reset disk. If this user has created a password reset disk, then he or she should use that disk to set the password.

If the user knows the password and wants to change it, he or she should log in, then use the User Accounts in Control Panel to change the password.
You are Resetting the password for user name. If you do this, user name will lose all EFS-encrypted files, personal certificate, and stored passwords for Web sites or network resources.

To avoid losing data in the future, ask user2 to make a password reset floppy disk.
To avoid data loss because of a password reset in the future, create a password recovery disk to reset the password and have users change their own password while logged in.

To create a password recovery disk:
Click Start, and then click Control Panel.
Click User Accounts.
Click your user name.
Click Prevent a forgotten password, and then follow the instructions in the wizard.
Store the disk in a safe location.
------------------------------------------------------------------------------------------------------------------------

Would changing his Windows key to the original one defeat EFS? Dunno, but it could be worth a try, I guess... if you have your original key, you can change the one you have now to the original one using something like rockXP...

If I installed XP again, using the first CD that it was encrypted with, would my files decrypt? I just learned that almost all of them are, so this really, really sucks.

Soda > That's what I was thinking, but if that works, you wouldn't have to reinstall the first XP again... you could just change the key to that of the first one... I think :D

Quote:

---

In Windows NT and Windows 2000, passwords are stored in the Security Account Manager (SAM) database. The password values themselves aren't stored in the SAM - instead, the hashed values of the passwords are stored there. If an attacker could obtain a copy of the SAM through some means, he could conduct a brute-force attack, in which he would generate the hash of every possible password and compare each to the hashes in the SAM database. When he found a match, he would know the password for the account.

Syskey thwarts this attack by encrypting the SAM database using strong encryption. Even if an attacker did manage to obtain a copy of the Syskey-protected SAM, he would first need to conduct a brute-force attack to determine the Syskey, then conduct a brute-force attack against the hashes themselves. This dramatically increases the work factor associated with the attack, to the point where it's considered to be computationally infeasible.

---

which can be found here

a pay for tool can be found here

perhaps a free download here

let me know if that one works

Again from Microsoft.

Why You Must Back Up Your Certificates
Because there is no way to recover data that has been encrypted with a corrupted or missing certificate , it is critical that you back up the certificates and store them in a secure location. You can also specify a recovery agent. This agent can restore the data. The recovery agent's certificate serves a different purpose than the user's certificate.

Looks like your only option is to go to the dark side.

Quote:

---

Looks like your only option is to go to the dark side.

---

Yeah, Linux.


Product key changes haven't worked. Neg's link and another have both failed. They don't change, and XP says its already activated.

"The dark side", what i mean is this. (and this is just me making an educated guess)
You have a file and want to encrypt it. You do the right click properties stuff. Windows scramples the file and produces a certificate that has the encryption key, and makes a link between your account, so you can view the file when neaded.

When you re-installed xp that certificate/key was lost. So no access to the files. I think your only option is to find an encryption cracker. And get your prayer mat out.

I totally knew what you meant :D

I was sorta joking about switching to a nix, but I don't know now. This might be a good opportunity to throw on a distro. I haven't found anything that can crack the file. And what sucks even more, is that I threw out the hard copy on accident today. I swear, everything is going wrong for me today (And it this had to happen before finals.)

Soda,

I have a small suggestion. It probably won't work but you never know.

I know Knoppix-STD has some password tools. Here's the list from their site

Quote:

---

password tools
/usr/bin/pwd-tools/

* john 1.6.34 : John the Ripper password cracker
* allwords2 : CERIAS's 27MB English dictionary
* chntpw : reset passwords on a Windows box (including Administrator)
* cisilia : distributed password cracker
* cmospwd : find local CMOS password
* djohn : distributed John the Ripper
* pwl9x : crack Win9x password files
* rcrack : rainbow crack

---

You could boot up, mount the hard drive, get the file and crack it. I'm not familiar with some of those tools so I'm not sure if they would work at all.

I hope you get this figured out. It seems like things ALWAYS go wrong right when you've got something important coming up.

mjk

Just a thought: Could you possible boot to Knoppix or SLAX or some sort of other live distro, open the file using open office which is built into knoppix std i know and maybe some of the other ones, then save it as something else on a floppy or on a *nix partition? Or would the encryption still screw it over?

The file is encrypted, you can't get at it unless you decrypt it first. As of now, biblio.doc (the file) Is just a ton of meaningless data with a .doc extension. It would have to be decrypted for a boot disk to transfer it into meaningful data.

I don't think I have a chance.

Certainly looks that way... At any rate I can't think of anything other than using some sort of cracking program against it... If there are any that crack EFS out there...

Good luck!

Well just to confirm what jinxy said, I'm sorry to say but basically... your screwed!

... unless ...

The only way to recover that data would be to have a backup of your private key which is/was located in your user profile (\Documents and Settings\username\Application Data\Microsoft\Crypto\RSA ) or that of a user designed as recovery agent. If by any chance you do have a backup of your old user profile, then you're probably in luck: check http://www.microsoft.com/technet/com.../5min-401.mspx for more instructions to restoring the keys and recovering your documents...

And btw, linux boot disks and other usual tricks for bypassing NTFS restrictions will not help in this case; EFS was designed precisely to protect against these types of "attacks" (although there are weaknesses making it possible to access the user keys if not using password protected syskey or syskey on a floppy, but this doesn't apply here: nobody has the keys period!).

Oh, and there are no cracks to decrypt EFS encrypted files themselves: on Win XP, the default cipher is DESX optionnaly 3DES, and with SP1, it's now 256bits AES. So good luck bruteforcing that...


Ammo

I have not found a solution yet but i thought i would post this as it contains some good info on how EFS works:

Before considering EFS hacks you should have a basic understanding of how it works. EFS is only available when using the NTFS file system on a Windows 2000 or Windows XP Professional computer. Operations are slightly different if the Windows 2000 computer is joined in a Windows 2000 domain, if XP is the operating system, and whether certificates have been issued via a certificate authority, or via the built in self-signed certificate mechanism. When a Windows user wishes to encrypt a file he has only to select ‘encrypt’ from the advanced button on the file properties page, or save the file in a folder that has been previously marked for encryption. Thereafter, encryption and decryption is transparent to the user. The file is decrypted when opened and encrypted when saved. Should another user of the file system attempt to open the file, access is denied.

The full article is here: http://www.sans.org/newsletters/hacking_efs1.htm

This is what confuses me now...

I don't ever remember turning on efs encryption on the drive. What's even weirder is the randomness of the files that are encrypted. I had my whole site on that drive, and in each folder, a few files have been encrypted, the rest haven't been encrypted and I can still access.

Weird huh? Anyways...

Time to type up a new bibliography. Thanks for the sandwich galdron (mmmmm md5...).

EFS has a weakness that windows use to store the key INTO the file system. If you cant remember that you encripted the files, probably you didnt export the key (that is a good pratice) and remove it from disk. Therefore, key is still there. So you can use a commercial tool to crack it.
here is an example http://www.elcomsoft.com/aefsdr.html?from=passcr
(I never used a tool like that.....)
EFS is near unbreakable if you didnt store keys on encripted disks. AND its create do be that.