michael879 Posted November 8, 2006 Report Share Posted November 8, 2006 ok last month I had no clue what certificates were. Some abbreviation made me think they were related to https. I kept being blocked by a site by something I couldnt figure out. It was browser dependent so it wasnt my IP (turned out to be user agent). Stupidly, I went into certificates a removed a bunch of them. One of them was the one used for file encryption. This was about a week after I had encrypted all of my documents.Ive read that removing certificates doesnt delete the key, which is good since I know how hard RSA is to crack (Id have to build a quantum computer). Im pretty sure Ive found some files from my old certificate since they match the new one pretty well. the files are:C://documents and settings/Michael/Application Data/Microsoft/Crypto/RSA/some long hex numberthere are 5 files here, 2 are completely irrelevant (unless JSE and JavaWebStart are random strings) and one simply has a bunch of "blanks" and then my name. The other two are long, and contain two hex numbers one of which is the thumbprint of my current certificate. The two documents are very similar but the hex numbers are different.C://documents and settings/Michael/Application Data/Microsoft/SystemCertificates/My/Keys/some long hex numberthere are two files here, both very similar to each other. They also both contain the long hex numbers contained in the previous two documents.C://documents and settings/Michael/Application Data/Microsoft/SystemCertificates/My/Certificates/some long hex numberThere is only one file here, and it contains one of the hex numbers in the previous documents.Since it seems like the key file is still there for my old encryption (and Ive read people mentioning restoring removed certificates) Im guessing there must be some way to recover my documents. any help? Quote Link to comment Share on other sites More sharing options...
cozofdeath Posted November 9, 2006 Report Share Posted November 9, 2006 I would first try login in as the default admin or whatever recovery agent you have and see if you can decrypt the files that way first.You could also try changing your password through the control panel, user account tool, restarting, login then change it back to the original, restart, login. Then try using cipher.exe from a command prompt to backup your efs cert/keys. If you have cipher, xp home does not. Or maybe this...http://www.beginningtoseethelight.org/efsrecovery/index.php Quote Link to comment Share on other sites More sharing options...
michael879 Posted November 9, 2006 Author Report Share Posted November 9, 2006 I never changed my password and I am the admin. Before this problem I didnt know anything about windows encryption so I didnt make a recovery agent. The only way I can think of to fix this is to make a new certificate from the files that were left behind. However I have no idea how to do this. Im almost positive that the key is somewhere in the 2 kb file in the keys folder but Im also guessing that the public key is the hex number that is in all of them and the private key is probably encrypted or something. Quote Link to comment Share on other sites More sharing options...
michael879 Posted November 13, 2006 Author Report Share Posted November 13, 2006 umm can I get some help? its been days Im worried the data may be deleted eventually. Quote Link to comment Share on other sites More sharing options...
cozofdeath Posted November 13, 2006 Report Share Posted November 13, 2006 It shouldn't be deleted and the stuff I posted above should work. I think you can create a new private key and certificate with the cipher /K command which I believe is usually recreated every 90 days anyway. What exactly did you delete? Quote Link to comment Share on other sites More sharing options...
michael879 Posted November 13, 2006 Author Report Share Posted November 13, 2006 I would first try login in as the default admin or whatever recovery agent you have and see if you can decrypt the files that way first.You could also try changing your password through the control panel, user account tool, restarting, login then change it back to the original, restart, login. Then try using cipher.exe from a command prompt to backup your efs cert/keys. If you have cipher, xp home does not. Or maybe this...http://www.beginningtoseethelight.org/efsrecovery/index.phpwhy wouldnt it be deleted? windows thinks I meant to remove the certificate (I removed the personal certificate for encryption). I know the files still on my computer because I ran the free trial of EFS and it found the key, but if the file is in my recycling bin or something it may be deleted...anyway, what did you tell me that would help? I am the admin of my computer, I have no recovery agent, and I dont see how changing my password would do anything, I deleted the certificate and now the new one uses a different key. I didnt see that link and the cipher command before, Ill check them out. Quote Link to comment Share on other sites More sharing options...
michael879 Posted November 14, 2006 Author Report Share Posted November 14, 2006 ok well I checked out the cipher program. I dont see how you think this would help me at all. Did you read my post? none of the options seem to help, and the one u suggested, /K just creates a new one. I need to restore an old one that had its certificate removed... Quote Link to comment Share on other sites More sharing options...
cozofdeath Posted November 14, 2006 Report Share Posted November 14, 2006 Ok, sorry I might of misunderstood. Tell me exactly what you deleted and I will do the same on my machine and see if I can find a way to fix it. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.