BitLocker and EFS - Huge Mess, Need Help

[vegoen]

I encrypted data across multiple drives using Bitlocker. Then I moved them to an external drive which I also encrypted. After that, I moved the external to a laptop with a different OS. Some files appear green, which means they were encrypted using EFS. I don't have the certificate for the EFS files but I have the password and bitlocker key. Any recommendations on what to do?

- Original Computer is not in the equation

- I have BitLocker Key and Password, however the EFS files do not allow me access.

I've heard of a cipher program but this will only help if I can restore the certificates.

Please help!

 

[imagoon]

Loss of the certificate [there is a back procedure, did you happen to do it?] = you have nothing now. The password unlocks the cert which is then used to unlock the file.

 

[vegoen]

Any decrypting software that can be recommended?

 

[imagoon]

Nope. There is no "cracking" software out for EFS. All of the attacks relied on accessing a "key recovery account." All the original certs would have been stored on the original computer or a password recovery disk.

The cert is a min of 256 bit or a max of 16kbit. if you used a 16kbit cert you would likely die of old age before even one file was unlocked.

 

[gsaldivar]

Ouch.

 

[Berryracer]

I have never been a fan of BitLocker for this reason!

Say bye bye to your files

 

[imagoon]

Personally I consider it a feature. What is the point of encryption if it takes some decryption program 10 seconds to crack?

 

[Nothinman]

I have never been a fan of BitLocker for this reason!

Say bye bye to your files

You're not a fan of encryption because the files you've elected to encrypt are gone when you lose the key? Isn't that the point?

 

[vegoen]

So I have the original hard drive that had the operating system on it, however it was wiped using Auslogics. Is there a way to recover it?

 

[Gooberlx2]

So I have the original hard drive that had the operating system on it, however it was wiped using Auslogics. Is there a way to recover it?

So it doesn't still have the OS on it? You deleted everything with either their File Shredder, or retroactively with Disk Wiper?

Sorry dude, you're SOL. Looks like the whole purpose of those programs is secure-erasing (likely by writing over the previously used sectors several times with random bits).

 

[vegoen]

So I now have the original hard drive with the original OS, it's connected to a different system however. I'm using a program called Advanced EFS Data recovery. Its found a bunch of efs related private and master keys. Is this what I would need to decrypt for the certificates? The license costs $150.

Also, I dont understand why the files are green EFS when accessing the hard drive itself. Why would it have inaccessible files within the OS drive itself?