![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
I
Ice Czar
Guest
http://www.elcomsoft.com/aefsdr.html
Advanced EFS Data Recovery
Advanced EFS Data Recovery (or simply AEFSDR) is a program to recover (decrypt) files encrypted on NTFS (EFS) partitions created in Windows 2000 and Windows XP. Files are being decrypted even in a case when the system is not bootable and so you cannot log on, and/or some encryption keys have been tampered. Besides, decryption is possible even when Windows is protected using SYSKEY. AEFSDR effectively (and instantly) decrypts the files protected under Windows XP (including Service Pack 1) and all versions of Windows 2000 (including Service Packs 1, 2, 3 and 4).
Personal License $100
Unregistered version can be used during 30 days after installation
(although it doesn't expire, actually) and has some limitations.
The program can decrypt protected files only if encryption keys
(at least, some of them) are still exist in the system and have
not been tampered.
- Only "Basic" (but not "Dynamic") NTFS partitions are supported.
- For files encrypted on Windows 2000, if Account Database Key
(SYSKEY) is stored on floppy disk, or if "Password Startup"
option has been set, you should know/have one of the following
in order to be able to decrypt the files:
- startup password or startup floppy disk
- the password of user who encrypted the files
- the password of Recovery Agent (if one is availbale)
- If the computer was a part of domain at a time when the files
were encrypted, you may not be able to decrypt the files in
some cases.
- If password of the user (who encrypted the files) have been
changed after encryption, you may need to enter the old password
into the program.
- The program has not been carefully tested on files encrypted on
Windows Server 2003.
- If files were encrypted under Windows XP (with or without SP1),
the password of user who encrypted the files (or Recovery Agent)
is needed for decryption.
- The program has been tested only on files created under U.S.
version of Windows 2000 and Windows XP; if any other (international)
version has been used, correct work is not guaranteed.
considering the certificates have been probably been overwritten its unlikely there is anything to decrypt
sorry but Id thought Id pass this on (found it a minute ago)
Advanced EFS Data Recovery
Advanced EFS Data Recovery (or simply AEFSDR) is a program to recover (decrypt) files encrypted on NTFS (EFS) partitions created in Windows 2000 and Windows XP. Files are being decrypted even in a case when the system is not bootable and so you cannot log on, and/or some encryption keys have been tampered. Besides, decryption is possible even when Windows is protected using SYSKEY. AEFSDR effectively (and instantly) decrypts the files protected under Windows XP (including Service Pack 1) and all versions of Windows 2000 (including Service Packs 1, 2, 3 and 4).
Personal License $100
Unregistered version can be used during 30 days after installation
(although it doesn't expire, actually) and has some limitations.
The program can decrypt protected files only if encryption keys
(at least, some of them) are still exist in the system and have
not been tampered.
- Only "Basic" (but not "Dynamic") NTFS partitions are supported.
- For files encrypted on Windows 2000, if Account Database Key
(SYSKEY) is stored on floppy disk, or if "Password Startup"
option has been set, you should know/have one of the following
in order to be able to decrypt the files:
- startup password or startup floppy disk
- the password of user who encrypted the files
- the password of Recovery Agent (if one is availbale)
- If the computer was a part of domain at a time when the files
were encrypted, you may not be able to decrypt the files in
some cases.
- If password of the user (who encrypted the files) have been
changed after encryption, you may need to enter the old password
into the program.
- The program has not been carefully tested on files encrypted on
Windows Server 2003.
- If files were encrypted under Windows XP (with or without SP1),
the password of user who encrypted the files (or Recovery Agent)
is needed for decryption.
- The program has been tested only on files created under U.S.
version of Windows 2000 and Windows XP; if any other (international)
version has been used, correct work is not guaranteed.
considering the certificates have been probably been overwritten its unlikely there is anything to decrypt
sorry but Id thought Id pass this on (found it a minute ago)