If you use NTFS Encryption, read this

[egeekial]

Ok, my primary hard drive with my windows install failed (i think it was just a mechanical failure because it made funny sounds). and, my second drive had encrypted files and of course i didn't have the key backed up. I still have the hard drive and am wondering if there is anyway i myself can extract the data from the dead drive without risking erasing it all or how much it would cost to have someone else replace the motor or whatever is bad...

 

[straubs]

I always wonder what all these home users are encrypting... I mean, are you committing treason? Adultery? Seriously, what's the point? I can understand it in a business scenario, but a home user?

That is UNLESS you are using a laptop. In that case, you certainly don't want someone to be able to steal your laptop, then go browsing your stuff...

 

[Mrburns2007]

I recommend PGP 6.58ckt build 08 which is the last freeware version.

PGPdisk can be any size and mounting it is easy, plus all you need is the password. Also backing up all your secure files is easy since you can just burn it to a cd or dvd.

 

[exx1976]

[sarcasm] You recommend PGP? And it only uses a password? Wow, those are SO Much harder to figure out than crasking a 128-bit encryption key!! It MUST be good! [/sarcasm]

LOL!!

And whoever made the remark about it taking more than a lifetime to crack a 128-bit key, There was a Distributed Computing thing done not too long ago where a 512-bit RSA key was cracked in just under a year, IIRC...

 

[KenSr]

Thanks

 

[NicColt]

I have a question regarding this. If I burn the encrypted directory to cd-r will the encryption follow it or does it only stay on the HD. Same goes if I burn a file from the encrypted directory does that mean that the file is still encrypted or is the file un-encrypted once it leaves that directory ?

>I always wonder what all these home users are encrypting...

Well about 10 years ago someone stole two computers that I had, it basically had my life in it, financial/stock statements, bank/tax records. Documents I wrote for my work's security clearance, passwords, personal emails and so on. An identity theft superstore, now I have my personal stuff encrypted and backed up on two diff cd's. If it were to happen again I wouldn't be worried at all this time coz first they can't read the data and second I have backups. It's more of a privacy thing.

 

[stash]

Think about that for a sec...encryption (at least the Microsoft implementation) requires NTFS. You can't have the NTFS file system on a CD or floppy. When burn a file to a CD or copy it to a floppy it will be decrypted.

If you were to copy a file from a CD into a directory that is encrypted, that file will become encrypted.

 

[Mrburns2007]

Originally posted by: exx1976
[sarcasm] You recommend PGP? And it only uses a password? Wow, those are SO Much harder to figure out than crasking a 128-bit encryption key!! It MUST be good! [/sarcasm]

LOL!!

And whoever made the remark about it taking more than a lifetime to crack a 128-bit key, There was a Distributed Computing thing done not too long ago where a 512-bit RSA key was cracked in just under a year, IIRC...

You have the option to choose what type you want to use. I currently use twofish 256 bit and if your really paranoid you can place the container inside another container and so on.

EFS has some downsides which is why I switch to PGPdisk, plus backing up files is easier that way.

 

[kamper]

Originally posted by: NicColt
I have a question regarding this. If I burn the encrypted directory to cd-r will the encryption follow it or does it only stay on the HD. Same goes if I burn a file from the encrypted directory does that mean that the file is still encrypted or is the file un-encrypted once it leaves that directory ?

>I always wonder what all these home users are encrypting...

Well about 10 years ago someone stole two computers that I had, it basically had my life in it, financial/stock statements, bank/tax records. Documents I wrote for my work's security clearance, passwords, personal emails and so on. An identity theft superstore, now I have my personal stuff encrypted and backed up on two diff cd's. If it were to happen again I wouldn't be worried at all this time coz first they can't read the data and second I have backups. It's more of a privacy thing.

What do you need to access your own files? Just a login password? Cause that's easy to crack. If your os install remains intact when someone punks your box then encryption won't really stop them will it?

 

[JohnProphet]

Quote--> "Think about that for a sec...encryption (at least the Microsoft implementation) requires NTFS. You can't have the NTFS file system on a CD or floppy. When burn a file to a CD or copy it to a floppy it will be decrypted.

If you were to copy a file from a CD into a directory that is encrypted, that file will become encrypted."

Nope, doesnt work that way. For one thing that would be an obvious first attempt everyone would try, lol.

JP

 

[stash]

Nope, doesnt work that way. For one thing that would be an obvious first attempt everyone would try, lol

Uh, actually that's exactly the way it works. EFS is an attribute of the NTFS v5 file system. When you remove a file or folder from a partition that is formatted with NTFS to a non NTFS partition, it looses that attribute. It is no longer encypted. Same thing if you move a file from a non-NTFS volume to an encrypted folder on an NTFS partition. It will inherit the properties of that parent folder, and become encypted.

If you move an encypted file or folder to a different NTFS partition, it will stay encrypted. The only way to copy an encypted file to a non-NTFS v.5 partition such as a floppy or CD is to back it up with the ntbackup utility, then save the backup file to the removeable media.

I suggest you read the following article before you come in here making sweeping generalizations about EFS without any facts to back them up.

http://www.microsoft.com/windows2000/techinfo/planning/security/efssteps.asp

 

[dzt]

I never use any additional encription on NTFS partition, just as it is.
Till now, if my win$ screwed, I use linux to recover files (unencrypted files).
Does anyone know, is linux able/unable to recover encrypted files ?

 

[fish168]

I'm using win XP pro... I have few user accounts, one acct has password. yesterday my window having lots weir problem, so I repair windows without deleting all my files. just reinstalled windows on top of the old one... now i can find all my old files except the ones that are in the password user account. i tried to go in c:/documents and setting/my pass acct. it said access denied. the new window installation delete all my previous user accounts, so I can't log back in even i know the password..

after reading this post, sounds like i can't get them back since i didn't backup my private key. if so, then how do i delete them all. at least wont take up my HD space...

thanks for the help in advance.

 

[RadDreamer]

Originally posted by: STaSh
The probability of brute forcing a 128-bit key in a lifetime is so small that it is impractical to even attempt it.
.

Well, give it a few years, cpu power will be leaps and bounds higher and this wont seem so improbable

 

[NicColt]

>it said access denied.

you just need to reset the permissions for that directory, folder or drive, I did that today actually after moving a win2k ntfs drive into XP.

 

[easternerd]

If you are in a Domain Environment and your installation is corrupt or your password was lost then
the assigned recovery agent us a/c of the domain can recover the files.. though he needs the certifcate
(recoveryagent) from the CA.

 

[fw3308]

I am not sure if this was covered in later posts but there is a way out of the encryption nightmare if you lose your private key. If you have more than one partition or hard drive set it to be compressed. By default a file cannot be encrypted and compressed at the same time. Take ownership of the file or folder or whatever and move it to a compressed folder, partition, and/or drive and the encryption will go away. I made this mistake once and that is how I was able to get out the mess without losing data or reloading a system.

 

[arsbanned]

So, all someone need do to get at your encrypted file is put it into a compressed folder?
Color me confused.

 

[NightCrawler]

Originally posted by: arsbanned
So, all someone need do to get at your encrypted file is put it into a compressed folder?
Color me confused.

That's why I stopped using EFS, it had to many weakness, with PGP disk or other similiar app you have more control and better encryption.

 

[stash]

Take ownership of the file or folder or whatever and move it to a compressed folder, partition, and/or drive and the encryption will go away.

This is just plain wrong. The file is still encrypted...moving it into a compressed directory will not just magically remove the encryption.

 

[AndyHui]

it had too many weakness

What weaknesses? It works exactly as it is designed to work.

 

[NightCrawler]

Originally posted by: AndyHui

it had too many weakness

What weaknesses? It works exactly as it is designed to work.

Doesn't work well in a network enviroment where you have 98 machines still. It's also hard to teach noobs how to use it even though it was intended to be be transparent sometimes noobs don't realize that there files aren't encyrpted at all.

We solved these problems by using a third party app that they right click a file or files and encrypt them, which then adds a encyrpted extension to the end of the file. The noobs seem to find the app easier to use and it's used for files that need to be circulated to the management the password is changed every week.

PGP disk is also used cause it easy to place all memos, docs and work product into a PGP disk and open and close it.

 

[AndyHui]

Doesn't work well in a network enviroment where you have 98 machines still. It's also hard to teach noobs how to use it even though it was intended to be be transparent sometimes noobs

Neither problems you list are the fault of EFS itself.

 

[vortix]

Originally posted by: egeekial
Ok, my primary hard drive with my windows install failed (i think it was just a mechanical failure because it made funny sounds). and, my second drive had encrypted files and of course i didn't have the key backed up. I still have the hard drive and am wondering if there is anyway i myself can extract the data from the dead drive without risking erasing it all or how much it would cost to have someone else replace the motor or whatever is bad...

Your best bet is to use a program like Norton Ghost (with the force cloning option enabled) to try to recover the data. If it can't get anything, run chkcsk /R on the drive and then try Ghost. If that doesn't work, try connecting the drive as a secondary hard drive and see if you can pull any files off of it. Finally, if that still does not work, you'll need to send it to a data recovery company, which will charge you a minimum of $1000 (probably closer to $1500) to recover the data.

 

[Davegod75]

i've done this twice before...yes 2 times.

damn my memory