EFS Certificate location

[Guest]

I Have hp Desktop with Windows xp installed in it, Few days before it was infected with Trojan/w.32.
I Just simply copy all of my Files to the External HDD and run the HP restore CD.
Now while i trying to restore/open it the files error coming, Read only or Encrypted files.
These files was not encrypted before.

Kindly suggest how i can recover these files.
OR Is it possible to recover the certificate after run restore CD.

Please please help me......


Regard's
Baig

 

[Saga Lout]

If the new installation doesn't have the same password structure as the old, you're going to be in trouble here. Try recreating the User Account exactly as you had it before and post back if that doesn't work. You may need to use Linux to tunnel your way in.

 

[Ijack]

I don't think that's going to work. User IDs are identified internally by SIDs; unless those match then it doesn't matter if names, passwords, etc. are identical.

If the files have been encrypted with the EFS and the original UserID and password aren't available then, basically, you're stuffed. Linux isn't going to help if the EFS has been used. There are utilites/places that claim to be able to recover such files but they tend to be pricey.