Windows Locked out of self-encrypted folder from Windows 10

Discussion in 'Software' started by dawg218, 12 Jul 2017.

  1. dawg218

    dawg218 New Member

    Joined:
    10 Oct 2005
    Posts:
    26
    Likes Received:
    0
    I had a Nextbook running windows 10 (don't ever buy a nextbook... they're junk) and while I was playing with it for a while, I guess I encrypted a particular folder on an external hard drive. I didn't think anything of it, that I would decrypt it when I had time.

    Well, I ended up having to sell it to someone for gas money, and forgot about decrypting this folder. Normally not a big deal, but I can't replace these pictures. Some are of my own grandfather holding my daughter, he has been deceased for 8 years so yeah, irreplaceable.

    I'm currently using (for now) a laptop running windows 8.1 that I got essentially for free. The encrypted files are on an external 3TB USB drive. I can see every other file, and there are a lot. I can "see" every file, but can't open any of the ones in this particular folder.

    I have (I think) all the files from win10 backed up as they would appear in File Explorer. Is there any way I can gain access to my encrypted files? Perhaps running a virtual machine?

    One other thing that, to me, suggests a bump in the road: I have tried two or three times to update Win8.1 to Win10 but my computer crashes on me every time I try. So, no upgrades for this machine... if I end up getting a new Win10 laptop, I'm thinking the 8.1 machine may turn dual-boot.
     
  2. wolfticket

    wolfticket Downwind from the bloodhounds

    Joined:
    19 Apr 2008
    Posts:
    2,497
    Likes Received:
    102
    If you used the EFS (Encrypted File Service) built into Windows then as far as I know you need a backup of the encryption key/certificate from the account/install they were encrypted to decrypt them on a new system or fresh install.

    As far as I can tell unless you have this then I'm sorry to say the files are as good as gone (double check this though).

    The nature (and danger) of effective encryption is that unless you have the key it is just as hard for the original owner to access as it is for anyone with nefarious intentions. In this case the key was stored within the system files of the Nextbook, not on the external drive where the files are (unless you backed up the key/certificate).
     
  3. Gareth Halfacree

    Gareth Halfacree WIIGII! Staff Administrator Super Moderator Moderator

    Joined:
    4 Dec 2007
    Posts:
    8,922
    Likes Received:
    188
    Ouchie. Like Wolf says, the encrypted copies you have on your external drive are useless. The only recourse you have for getting those files back is to get the original laptop back, and if the drive has been wiped attempting to recover the private key.

    It's a bit late now, but it's a good time to discuss backups. If you have irreplaceable files on a single device, this will happen. Always, always, always have backups of anything irreplaceable. It won't help you now, but this advice will prevent the same happening again in the future.

    You don't even have to spend any money: if you already had an external drive, just keep a copy on that as well as your laptop (protection against the laptop or the external drive dying, not protection against fire or particularly thorough theft). If you don't have an external drive, look at using CrashPlan or similar: this will allow you to create an encrypted backup on a friend's storage completely free of charge. If it's just photos, Flickr will let you back up up to a terabyte of photos and videos again completely free of charge.
     
  4. dawg218

    dawg218 New Member

    Joined:
    10 Oct 2005
    Posts:
    26
    Likes Received:
    0
    You mentioned EFS but I can't remember if I used that one, or another one to do it. Either way, it was something that came with the computer. Is there a way to determine which program would have been used?
     
  5. wolfticket

    wolfticket Downwind from the bloodhounds

    Joined:
    19 Apr 2008
    Posts:
    2,497
    Likes Received:
    102
    If it is the EFS built into Windows you might be able to: right click>properties>advanced on the file an see if "encrypt contents to secure data" is ticked. I'm not sure how windows handles encrypted files from another install though.

    Do the files show up in explorer as you'd expect but you just can't open them? Maybe even they have a little padlock on the icon?
    If so it's likely they are encrypted with something Windows can handle natively, so probably EFS.

    If they have no or unrecognised file extensions is could be some other encryption software. In this case unless it is clear from googling the file extension there is often no easy way of determining the program used to encrypt the file, as again the nature of security is that to any other software and without the key files of that type will just look like random data.
     
  6. dawg218

    dawg218 New Member

    Joined:
    10 Oct 2005
    Posts:
    26
    Likes Received:
    0
    Sorry for the delay in response. I work an insane work schedule.

    I right click Properties > Advanced and "encrypt contents to secure data" is ticked, but cannot be unticked - it is greyed out and selected.

    The files do show up as one would expect but cannot be opened. When I click any file, I get this message: "Windows Photo Viewer can't open this picture because you don't have the correct permissions to access the file location." No padlocks on icons.

    The file extensions are the typical JPEG image files. I believe (don't quote me here) there might be an MPEG4 or similar file or two somewhere in the folder.

    I'll do some more Googling and see if Windows can handle encrypted files from another install. Thank you for your assistance.
     
  7. noizdaemon666

    noizdaemon666 I'm Od, Therefore I Pwn

    Joined:
    15 Jun 2010
    Posts:
    5,563
    Likes Received:
    472
    The company I now work for does forensic data work, which includes decrypting encrypted files. If you want to send me a single file, I'll see if it's possible to get it decrypted.
     
  8. wolfticket

    wolfticket Downwind from the bloodhounds

    Joined:
    19 Apr 2008
    Posts:
    2,497
    Likes Received:
    102
    Would be worth a look I suppose, but unless the company you work happens to be the NSA or similar I'm pretty sure they cannot decrypt EFS without at least having access to the system/drive where the certificate is/was stored.
     

Share This Page