Retrieving data from an encrypted laptop hard drive

canivari

canivari

New Member
rudyard said:
Hi,

I have a works laptop with all my files stored on the hard drive. The laptop was encrypted by my work a few months ago. I want to retrieve my files on to another storage device, however it appears that the encryption is preventing me from using any sort of usb storage device and/or burning cds.

Does anyone know a way that I can retrieve my files from the hard drive of the laptop? (This is legit by the way- all the files are mine!)

Cheers,

R
Click to expand...

canivari said:
To retrieve those files you need to conect that HDD where you have those files and atach him to another PC where you have an administrator account.
After that you need to take ownership of the files and after that you can do whatever you want with them.
Hope that this solution isnt for you to get in someone else life...;)
Please note that after doing that, the NTFS permissions will not be the same and after you conect the laptop to the network in the Company,you will need to tell the IT guys that they should correct the permissions again because isnt safe to leave like that
Hope that helps
Click to expand...

tyttebøvs said:
You still have no clue as to what we are talking about.
Click to expand...

...:rolleyes:
Yes ..with that i am starting to really understand in wich world you live...
 
T

tyttebøvs

New Member
As I've told you. Look up the word "encryption". After that, look up what EFS is, so you can understand your answer in the other thread. If you one that actually takes those exams, you will also know.
 
canivari

canivari

New Member
All the Administrators in a Windows based machine that supports NTFS can take ownership of any EFS.
In this case, rudyard is just a user in the scenario and if he doesnt want to ask the guys from IT to modify the NTFS on those files he needs to atach the HDD in a Windows where he can be a Administrator and take ownership of the files..thats it..
Along with it it will screw with NTFS permissions.
 
T

tyttebøvs

New Member
Let me teach you a new word, which you should know if you were MCSE.

The only time an administrator can take ownership of other users EFS-files, is if he is a recovery agent.
 
canivari

canivari

New Member
tyttebøvs said:
No, you still don't understand EFS.

Another point. The OP didn't say what kind of encryption there was used.
Click to expand...

rudyard works in a medium ,big company that works with AD (if you dont know what that is, it stands for Active Directory where everything works with Share permissions,NTFS permissions and EFS...
If it was being used another type of Encryption i believe rudyard will tells us that he is using an Hardware Key or a specific program to acess to the files..
 
Last edited:
canivari

canivari

New Member
tyttebøvs said:
Let me teach you a new word, which you should know if you were MCSE.

The only time an administrator can take ownership of other users EFS-files, is if he is a recovery agent.
Click to expand...

All Administrators are "recovery agents" in all Windows...:rolleyes:
Ohh boy...you are slow heinnn...:D
 
canivari

canivari

New Member
And by the way you learn about recovery agent just berely being an MCP (70-270)..
 
Last edited:
canivari

canivari

New Member
Ohh man i think he choked..isnt online anymore...
Does anyone know is adress because i would like to send some flowers...
R.I.P. tyttebøvs
Well since i dont know your adress:
dead20flower.jpg

Here you go..you deserve them..
 
canivari

canivari

New Member
tyttebøvs said:
PC_eye was banned because of all his BS ...
Click to expand...

Tyttebøvs,
Seriously, whats wrong with you?
I have a person that is trying to help another one with background support (hyperlinks for the responsibles,explanations how they work and actually how to do it and you just stand there stating that isnt possible but you dont get any background support for your awnsers..??
Its just what you believe (not even the authors of the systems you believe??)
Now, I gave a solution to rudyard even if you dont agree (and if you dont agree show me and show rudyard were is wrong "with proves" and how to solve is problem correctly).
I allready had a lot of people like you, and in the end they just wanted some public atention..
Is tht what you are looking for?
 
T

tyttebøvs

New Member
Try and look at your answers (not just here, but also in other threads). Why should I use more of my time to help you? You state that you have taken the MCSE exam. I don't believe you (you cannot even understand the basis of encryption/EFS).

Encryption: if you think a little, do you really think that you can break encrypted files on a foreign harddrive just by resettings some permissions, just because you have administrative rights on your pc?

No more secrets in this world.

PS: I actually helped you by telling you about "recovery agents". Try and look it up at microsoft.com. They also have some lenghty documents about how EFS works.
 
H

heavybarrell

New Member
rudyard said:
Hi,

I have a works laptop with all my files stored on the hard drive. The laptop was encrypted by my work a few months ago. I want to retrieve my files on to another storage device, however it appears that the encryption is preventing me from using any sort of usb storage device and/or burning cds.

Does anyone know a way that I can retrieve my files from the hard drive of the laptop? (This is legit by the way- all the files are mine!)

Cheers,

R
Click to expand...

Has the problem been solved?
 
tlarkin

tlarkin

VIP Member
If the entire file system is encrypted, the only way anyone else can retrieve the data is that if the Admin that set it up, set up some sort of disaster recovery account so that in the event the user forgets their password, they can un-encrypt the drive.

If it is just the user's home folder that is encrypted then it usually uses some sort of key chain or password wallet, that uses the actual user's password to decrypt the drive.

If those passwords are not available, the data is done for the most part. As cracking encryption is not possible, unless it was TKIP encryption or another known exploited encryption. However, I am almost 100% certain that almost all file system level encryption products use some form of AES encryption, which is not currently crack-able.

/end of thread
 
tlarkin

tlarkin

VIP Member
I think he is confused because of the older feature in XP where you can make a folder "private" and if you boot off a power tool like ERD, you can modify the permissions to make it "un-private," but is not to be confused with actual encryption.
 
canivari

canivari

New Member
Well ,so have been a lot of luck in the all of the Computers that i hve been working and decryting..Because so far i was able to do it.
But you need to be an Admin in the Computer to do it!
And that is because you cant delete the Administrators or the System it self being at the level of NTFS permissions or else you could never retrieve them back if the user just died or went to anoter company..
After being connected to another PC,the encrypted files will be part of the sustem, and in this case in the system where you are an Admin,and with that you can take ownership of all the files and folders that you need asking under owner the option that says "Replace owner on subcontainers and objects" with your Admin account..and thats it..
Click in apply, he will warn you that you will change the owner of the files or folders and (unfortunately he will screw up the NTFS permissions but thats a small price to pay to decryp them)and OK.
Open the files and do what you need to do with them..
Please note again that after doing that, the NTFS permissions will not be the same and after you connect the laptop to the network in the Company,you will need to tell the IT guys that they should correct the permissions again because isnt safe to leave like that.
Yes?
 
tlarkin

tlarkin

VIP Member
canivari said:
Well ,so have been a lot of luck in the all of the Computers that i hve been working and decryting..Because so far i was able to do it.
But you need to be an Admin in the Computer to do it!
And that is because you cant delete the Administrators or the System it self being at the level of NTFS permissions or else you could never retrieve them back if the user just died or went to anoter company..
After being connected to another PC,the encrypted files will be part of the sustem, and in this case in the system where you are an Admin,and with that you can take ownership of all the files and folders that you need asking under owner the option that says "Replace owner on subcontainers and objects" with your Admin account..and thats it..
Click in apply, he will warn you that you will change the owner of the files or folders and (unfortunately he will screw up the NTFS permissions but thats a small price to pay to decryp them)and OK.
Open the files and do what you need to do with them..
Please note again that after doing that, the NTFS permissions will not be the same and after you connect the laptop to the network in the Company,you will need to tell the IT guys that they should correct the permissions again because isnt safe to leave like that.
Yes?
Click to expand...

Microsoft's version of POSIX NTFS Permissions is not the same thing as encryption. If you make a home folder private, ie no one can view it but the owner, you can modify the permission at the file system level to remedy this.

If it is actually encrypted you need the encryption passkey, otherwise it will just not work. If you were simply able to just decrypt anything with local admin access, how would that even be a valid security measure? I suggest you download and read the NSA security PDF on securing Windows servers and systems. There is a lot of good information about file system encryption in there.
 
You must log in or register to reply here.
Top