Encrypted files lost its flag 0x4000
Good news isthat I have the pfx certificate with the private key that encrypted those files. Bad news is that windows cannot decrypt them because if I right click to decrypt, I dont see the "Encrypt contents.." box checked, because the OS thinks that they are already decrypted. But when I open one of those txt files for instance, I get something like this: ...Qp4l} %21/,6...I installed many utils but no luck. I used certutil cmdlet in PowerShell to dump private key and also converted the pfx to pem. So, I have the original pfx, converted pem, and the private key.
I would like to decrpyt them with the private key I have, but I cannot. I tried openssl rsautil and aes-256... (which version do I use cbc, ebc...?) But after two days, no luck! I am probably using them with the wrong switches.Is there any way to reset the encrypted flag on these files or any way to decrypt them manually via the private key?
Thank you for your help in advance,
By the way, I have my wedding videos/images that are in this state as well... If my wife finds out... HELP!!!
August 22nd, 2009 9:04am
1) Backup important data now. Verify it was written successfully. This will prevent further loss and multiple recovery attempts.2) If you have backups, restore from those and see if things show up better.3) cipher /d /f "c:\path\file.name" -- You may try adding the "/i" switch if errors are reported -- You may use the /s:"c:\path" instead of a specific filename if you wish to do an entire directory and subdirectories. Note that actual non-encrypted files will be "decrypted" if in this path, so use with caution...4) Since you have the private key, you at least have a chance of using an EFS recovery software. If the above did not help, I would suggest trying one of these, one such product is Elcomsoft AEFSDR, your scenario (sounds like corruption) is one of their advertised areas that they may be able to help you recover from.5) Once recovered - backup the good copy of your data.
Free Windows Admin Tool Kit Click here and download it now
August 27th, 2009 11:58pm


