Green files names

[Papa P]

Okay, I'm no novice but needing help with a colleagues laptop!

XP Laptop had 3 profiles on it, with photographs in one profile. he decided to format the laptop to copied everything onto an external hard disk.

Once formatting and reinstalling XP had finished, everything was copied back over...but now the pictures have green file names.

I know this means that they have been encrypted by Windows (blue means compressed), but he is saying they were never encrypted. Obviously he cant actually open them now!

I am of the thinking that the NTFS permission are screwed up because its not the exact same profile that is the "owner" of the files, but i didnt think that would make a difference.

Anyone any ideas on how they can get these files opened or the encryption removed?

 

[Stu DemonD]

Do you still have the files on the external hard disk?

 

[5abr3]

Okay, I'm no novice but needing help with a colleagues laptop!

XP Laptop had 3 profiles on it, with photographs in one profile. he decided to format the laptop to copied everything onto an external hard disk.

Once formatting and reinstalling XP had finished, everything was copied back over...but now the pictures have green file names.

I know this means that they have been encrypted by Windows (blue means compressed), but he is saying they were never encrypted. Obviously he cant actually open them now!

I am of the thinking that the NTFS permission are screwed up because its not the exact same profile that is the "owner" of the files, but i didnt think that would make a difference.

Anyone any ideas on how they can get these files opened or the encryption removed?

If it wont grant you access to attempt to decrypt the files, the only way to brute force access i know of is to play around in the safe mode. Did he just copy the 'Documents and Settings' folder or copy the files out of the my pictures etc directly out of the folder they were stored in?

 

[payney1]

I had a problem a few months ago, whereby i needed to get some files from another hard drive, but when i tried to access the files i kept getting access denied. I found the following website worked for me.

http://forums.techguy.org/3542698-post1.html

Good luck hope you manage to sort it out

 

[Captain Mike]

arent they archived or read only format?

right click the file/folder then properties then make sure the boxes arent ticked for anything you dont want at the bottom.

 

[naaathaaan]

safe mode wont help, When you reinstalled windows XP did you configure the computer name and account names to match the details before you formatted it?

Ive had this problem before, trying to think how i got around it. I will do a bit of digging and get back to you if somebody else dosent.

 

[jug]

XP Laptop had 3 profiles on it, with photographs in one profile.

he is saying they were never encrypted.

if there were 3 profiles and the HDD used the NTFS file system then any files from any profile will show up as encryted to XP with a FAT32 file system UNLESS! those files were copied across directly by the user who encrypted them. even if the correct certificate was backed up before you switched to FAT32 the files will have a problem with the EFS attribute unless there were copied over correctly.

if you use profiles with an NTFS file system you should always backup your private key certificates for all profiles. this is done in internet explorer settings (the private key is a certificate, which you can export from IE)

i think it is too late to retrieve the required certificate unless a full backup of the HDD was made and is still available. if that is the case, go bakc to that backup, then copy the certificate, or even better copy all the files to a media using FAT32 file system.

as far as i am aware, there is no way to crack EFS encryption, so no certificate means dead files.

 

[Papa P]

Thanks for the info guys!

As i said, its one of my colleagues who has done it on his wife's laptop so guess who is in the bad books! I'm not sure on the file systems used, but my thinking was the whole NTFS to Fat32 to NTFS would mess about with the permissions.

I'll pass the information on to him and he can sort it out himself! I'll let you know what works...if anything!

 

[naaathaaan]

as far as i am aware, there is no way to crack EFS encryption, so no certificate means dead files.

not true, there will always be a way to retrive the files unless fully corrupted, even then there is still a chance.



Might be able to try this:


Make sure simple file sharing is off

Access that by, When viewing a folder such as my documents, click tools/folder options/view tab. Then uncheck "Use Simple File Sharing".

This then gives you access to NTFS permissions.

This is accessed by right clicking the parent folder in question, Then clicking properties. Then select the security tab.

Then click advanced. If you are the administrator it is then possible to add usernames to the allow access to these files.

I may be waaaaay off with this, But i will have a chat to some people in college tomorrow and let you know!

 

[jug]

sorry nathan but that wont work, only the file owner can change NTFS settings and that owner doest exist any more (no key means no owner). if anyone can change the NTFS settings then what is the point of encrypting in the first place?

you must get the certificate key. how you obtain it is up to you but without it the files are useless.

 

[ChrisUK]

Just be thankfull that its on XP's rubbish encryption and not Vista which uses Becrypt which has been approved for MoD use.

 

[naaathaaan]

sorry nathan but that wont work, only the file owner can change NTFS settings and that owner doest exist any more (no key means no owner). if anyone can change the NTFS settings then what is the point of encrypting in the first place?

you must get the certificate key. how you obtain it is up to you but without it the files are useless.

Yeah? worked for me when i saved files to a external hard drive, formatted the pc then transferred back, When configuring the pc i used the wrong details so it wouldnt let me access, when i used the above method it allowed me. I may be wrong in this case.

 

[payney1]

Just be thankfull that its on XP's rubbish encryption and not Vista which uses Becrypt which has been approved for MoD use.

We use Becrypt on All our laptops in work, it really is awesome..

:worship:

 

[ChrisUK]

We use Becrypt on All our laptops in work, it really is awesome..

:worship:

Have you got the enhanced with the USB Dongles? which must be put in at boot up along with a Username and password before it boots up?

 

[jug]

worked for me when i saved files to a external hard drive, formatted the pc then transferred back.

interesting :chin:

give it a go papa p and let us know how you get on.

 

[Papa P]

I've passed the details on, so I'll let you know what he comes back with tomorow!

As for Vista, its actually BitLocker that it uses for encryption.

And I demo'd BeCrypt for my work as well but decided on SafeBoot which we are rolling out just now. BeCrypt didnt have a feature we were looking for, not that i can remember what that was! :bang:

If anyone is looking for good, cheap and free encryption software for home, take a look at TrueCrypt...it seemed good but we couldnt use it because its not approved software and hasnt been fully tested by the industry yet.

 

[naaathaaan]

Thanks for the advice, Always helps.