Need help with windows XP EFS

[raphidae]

Hi,

I just reinstalled my computer, and after that I found that the floppydisk with my certificate on it was broken. So now I have a disk with encrypted files.

I did backup my profile, so I should have everything to decrypt the files.

I have:

*- The certificate & public key, which was in Application Data\Microsoft\SystemCertificates\My\Certificates\C394FA2E4079CCA0E2F57FA19C33F04F41163AEB

*- The private key, which was in Application Data\Microsoft\Crypto\RSA\S-1-5-21-776561741-1500820517-839522115-1003\b4e9627bb7799e0576dc354ad84a2c40_874aecbf-f9fe-4877-8ff3-a7c85536bac2

*- The SID of the user that encrypted the files (S-1-5-21-776561741-1500820517-839522115-1003)

*- A bunch of keys in Application Data\Microsoft\SystemCertificates\My\Keys, which should include the master key with which the private key is encrypted.

*- And at last, the password of the user the files were encrypted with.

If I copy the certificate in a new profile the certificate seems to be working, however if I try to export it it compains about a missing private key. Even when the private key is also copied to the right location.

I'm guessing that is because in XP the private key is encrypted with the master key which is obviously different on this new install so it can't read the private key.

I was hoping someone here knows a bit more about the master key, especially where it's stored exactly and possibly how to replace my current master key with the backed up one so that the private key can be read and I can decrypt some files!

Any other suggestions welcome and thanks in advance.

 

[raphidae]

I have found out that the master key is located in Application Data\Microsoft\Protect\<SID>. I know it's based off the users password (which I have) but I suspect the users SID is involved too, because copying the original master key into a new profile doesn't work. Windows won't use the key and simply generate a new one for the user.

Can anyone tell me more about how the master key is generated and maybe how to replace a master key by another one? If the master key is based off the SID, how do I change the SID of an existing user or create an user with a specific SID?

Or something like a manual way to decrypt the private key with the master key and encrypt it with a new master key or just making a pfx from the public and private key so that I can import it would be perfect too.

Thanks.

 

[raphidae]

WOOHOO, I found it and all my files are decrypted now.

The SID of the computer needs to be the same, as well as the user number and the user password. Then I could just drop in the certificate and private key in and it worked.