I was forced to repair my XP Professional using the original installation disk. Files I had encrypted are listed in green, but I cannot read them.
Is there a way to read the files or decrypt them? Can I recover the original encryption certificates or reconstruct them?
More info:
There were no hardware failures. The machine is exactly the same. After the repair, the original account and password was intact (I did not have to recreate the account or set a new password. When I booted, Windows’ login screen had my original account name and accepted the password I always used).
The first thing that happened when trouble started – I was unable to boot at all because one of the hive files had become corrupt or missing according to the error message on the blue screen. I backed up the files in system32/config and replaced SOFTWARE with software.bak and software.sav on various attempts. That made no difference.
Strangely, when I put the original SOFTWARE file back in system32/config, the machine booted to the login screen but told me that it could not verify my Windows license (error80090019).
I think, but can’t be sure, that rsaenh.dll had somehow become unregistered. I was unable to run regsvr32 in safe mode or recovery mode.
After trying to boot with the last known good configuration and many attempts at rolling back to a previous restore point (with windows boot disc, safe mode, UBCD4Win…), I did a repair installation.
All my documents appear to be intact. I need to re-install all my programs like Office and Notebook++, but otherwise everything appears to be fine.
(After all this, yes, I’ve learned I should have backed up my encryption certificates.)
Recover encrypted files or folders
http://windows.microsoft.com/en-au/…
Recovering Encryption Keys from Windows XP
http://www.techrepublic.com/forums/…
To view the certificates in a PKCS #7 file
https://www.microsoft.com/resources…
It is an area about which I really know zilch, but also inspires one to go hunt…
I found numerous references to an MMC snap-in, which it would seem is how to view assorted certificates… From this I tended to conclude they are are not in the registry itself, but had no idea where, until further research… See link below…
http://www.pcreview.co.uk/forums/2k…
This link is but one of many around MMC snap-in, and may be of some help to start afresh in your search?
http://progettista.ru/0735711585_ch…
My trawl used assorted strings, one of them being:
efs certificates snap-in
Which perhaps you might repeat?
Other hits around your situation do seem pretty definite in that an OS re-install make it highly unlikely you can recover either certificate or the files… And if so the regrettably they are gone?
Advice from those who are into efs is to export a copy of the certificate to external storage, and keep safe… But none of them specified hot to do it… Presumably it’s via the MMC snap-in?
Managed to find this item – refers to windows 2000 but may apply for xp too? It “does” show where the certificates for each user are stored. Worth a look-see at least… But very likely as you have overwritten the previous installation, the certificates you seek are gone.
http://tinyurl.com/pmukqdu
Whether or not a roll back of the installation is possible (thinking of an undo format etc. utility…) i wouldn’t know. I have used such software in the past with regard to reversing a format…
This item”may” be of interest/help…
http://www.easeus.com/resource/reco…
I have used easus successfully on a test basis., but not in any great depth. The critical item is that one should not have overwritten the files in question; that apart from the reinstall there has been little written to the drive thereafter…