This Might work for u
http://www.crackpassword.com/products/prs/otherms/efs/

deltree 5/7/2004 2:20:14 PM

I had a similar problem, I found if you used the windows backup utility to backup the files (making sure to uncheck 'keep security settings') and then restore them, the files were again usable.

michael 11/5/2002 9:20:23 AM

i had a similar problem to paul's comment..
my computer installed a scsi driver without asking me if it was a scsi..then it caused windows xp to stop loading and responding to any stimuli..thus i had to reinstall win xp
now part of my NTFS EFS files are completely unreadable!!!!!!!!!!!
i have tried for days to trick it into letting me decrypt it or atleast copy it! but NOOOOOOO......this is a BAD BAD situation if you had not worried about EFS and never saved a good backup key

jr 5/15/2002 3:48:33 AM

If you RE-install win2k server over itself, thus keeping all SAM and config options intact, it seems the server creates a new key pair for the Admin account, which now renders all Encrypted (by the admin) files/folders unreadeable since the new key pair is generated for both teh user ADMIN and the Recovery agent ADMIN (if their in their default config, which they are in our case). This is problem, as we have lost access to considerable information. Further checking shows that the original certificate for both USER admin and RECOVERY agent ADMIN are both intact and stored along with the new certificate in SystemCertificate. This can be determined by using EFSINFO.EXE with the /C /R /U options to produce a Certificate Hash thumbprint.

Now, if the original certificate's seem intact, how can we import or change the certificate usage back to the old one so we can decrypt/use the files?

We made an attempt at changing the hash string in HKCU/../EFS/CurrentKeys to the original hash string and rebooted, the edit we made stayed after the re-boot, but the files were still unaccesible, and eventually when we checked again (an hour or so later) the system had changed the key/hash value back to it's original value. This was only a shot in the dark attempt, and not a known way to fix this.

Please any help would be greatly appreciated as this is the companies DC and needs to be back up Tuesday morning, 1/22/02. Thanks.

Paul1/17/2002 1:51:09 PM