2

I am running SBS Server 2011. I encrypted a text file file1 and placed it under the documents folder in the user profile of user1.

Now I accidentally removed user1's account when I was adding/removing email accounts in the Exchange Management Console. When I tried to recreate user1 in windows SBS Console it says that it cannot be done because the profile already exists. I also cannot copy rename or take control of the profile user1 even when logged in under an administrator account as it contains encrypted files.

I have taken ownership of the file and have all permission except special permissions. Does anyone have an ideas or advice to recovery the encrypted file?

Wesley
  • 32,690
  • 9
  • 82
  • 117
user89352
  • 21
  • 2

1 Answers1

1

Assuming you used EFS to encrypt the file, the file encryption is based on the user's SID. When the user no longer exists in either the local SAM or the domain, the encryption can not be reversed unless one of two things are true:

  1. The EFS certificate for that user has been backed up.
  2. You previously created a domain recovery agent. It is my understanding that even if you created a domain EFS recovery agent, all files encrypted prior to the creation of the EFS recovery agent will not be recoverable by the agent.

You might want to have a look at this document "The Encrypting File System", specifically the subsection "Misuse and Abuse of EFS and How to Avoid Data Loss or Exposure." An important quote:

By far, the most frequent problem with EFS occurs when EFS encryption keys and/or recovery keys aren't archived. If keys aren't backed up, they cannot be replaced when lost. If keys cannot be used or replaced, data can be lost. If Windows is reinstalled (perhaps as the result of a disk crash) the keys are destroyed. If a user's profile is damaged, then keys are destroyed. In these, or in any other cases in which keys are damaged or lost and backup keys are unavailable, then encrypted files cannot be decrypted. The encryption keys are bound to the user account, and a new iteration of the operating system means new user accounts. A new user profile means new user keys. If keys are archived, or exported, they can be imported to a new account. If a revocation agent for the files exists, then that account can be used to recover the files. However, in many cases in which keys are destroyed, both user and revocation keys are absent and there is no backup, resulting in lost data.

Having said all of the above, you could also attempt to crack the EFS encryption using a tool like Elcomsoft's Advanced EFS Data Recovery.

Wesley
  • 32,690
  • 9
  • 82
  • 117