Restoring EFS encrypted files and dirs from backup?

Thread needs solution
truwrikodrorowrelupicugojestutroclulachosaswunuhospikigawakijosaswenomaruclojeueclikaspedrubewidebrisubrohutrurifruuagothunugekedrumucisiuobrobrecrupeslapuswosluprothethibakaslechurathikucli
Beginner
Posts: 1
Comments: 0

Tech details:

Acronis Backup & Recovery 10
Windows 7 x64 Professional

Here's my situation:

I have been doing periodic system backups of my desktop computer to an external portable hard drive. I have several directories containing sensitive information (email archives, tax and social security data, etc.) that I encrypted with EFS. I absolutely need those directories; some of them are Quickbooks and Quicken archives.

I had a system crash last week. I attempted to restore everything to the same hard drive using the latest boot disk (date of the latest for version 10 seems to be 9/2011) that I found on this support site. I kept getting the restore bombing in the middle of about 450 GB with a message that the archive is corrupted. (I know I should run "validate" on the archive to be certain, but I just haven't had the time... my laptop will take about 10 hours to complete this.)

So, perhaps I will need to drag individual folders of data off of the backup and just restore them to a new version of Windows on the desktop.

I tried working with the "Explorer" quick view of the last backup set on my laptop (Windows Vista Home). (I mean the view you get when you double click one of the .tib files.)

What I am finding is that the Explorer view of the backup does not permit any of the encrypted files to be dragged and dropped from the explorer window to a "real" directory. I realized that the EFS encryption on those files (from my desktop computer) is not allowing that access.

So, I found the "certificate" file, with extension .pfx, from when I set up the encryption on the desktop. I successfully installed this certificate file to the laptop, and I can view its fields in Microsoft Management Console and it is assigned to the laptop user account.

NOW when I double click an encrypted file in the backup set on that laptop, Notepad opens up and I do see data in the files from the encrypted files. (It came up blank before.) I'm opening up like log files that are encrypted and they show lines of log text.

HOWEVER... I have tried to restore individual encrypted directories from the backup set to my laptop by restoring by file. (By using Restore in Acronis and specifying individual folders to restore.) Nothing gets restored - just empty directories.

There is a field in the certificate in MMC - Enhanced Key Usage - that seems to be the issue:

Encrypting File System (1.3.6.1.4.1.311.10.3.4)

I found by Googling that if a .1 is present at the end of this code, then the usage is good for recovery, not just EFS. The "Intended Purposes" column in MMC says "Encrypting File System." Says nothing about recovery. I'm thinking that is the issue.

This is the only certificate I have. I do have the old hard drive from the desktop. I know there is a key ID written to the HDD that somehow is used by EFS.

I have a new hard drive on order. I am suspecting that the old hard drive had problems.

Two questions:

1) Will I be able to extract my encrypted data with what I have in hand now and see it in the clear on the desktop again?

2) Is there any way without doing a full partition level restore of obtaining the encrypted files in the backup set, by restoring by file or directory?

Thanks.

Sun, 06/29/2014 - 23:20
0 Users found this helpful
truwrikodrorowrelupicugojestutroclulachosaswunuhospikigawakijosaswenomaruclojeueclikaspedrubewidebrisubrohutrurifruuagothunugekedrumucisiuobrobrecrupeslapuswosluprothethibakaslechurathikucli
Forum Star
Posts: 124
Comments: 2669

Hello Donald,

if you stored files in an encrypted state according to our user guide you will be able to restore them only by the user who encrypted the files/folders and on the same machine. So the safest way would be to perform full volume restore to the old drive. If you suspect that the disk has problems you can first create a sector-by-sector backup of all data on this disk and run chkdsk.

Thank you.

Wed, 07/16/2014 - 06:07
Abigo autem causa dolore scisco. Conventio defui dolor elit feugiat lucidus natu populus praemitto. Abbas ad facilisi. Defui ea gemino suscipere. Consectetuer eros interdico minim. Esse incassum plaga. Caecus decet dolore ille iriure neque. Gilvus letalis mauris paratus quis tego. Brevitas capto erat gemino loquor ratis tincidunt vulpes. Appellatio haero humo iustum luctus natu similis. Conventio decet eros humo praemitto ratis ullamcorper virtus. Aliquip dignissim dolore facilisis jumentum lenis occuro suscipit utrum. Esca gilvus haero ideo nutus persto quidne refoveo usitas. Adipiscing cui nisl odio paulatim quadrum qui venio virtus. Caecus letalis natu nunc pertineo praesent utinam. Caecus eligo jugis nimis tamen te. Ad diam dignissim gravis iusto magna praemitto. Augue gravis magna obruo plaga valde. Et humo molior saepius. Adipiscing aliquip lenis paulatim quadrum wisi. Duis in voco. Consectetuer gravis plaga populus quia. Commoveo consequat distineo exputo iustum nisl saepius. Appellatio genitus ille melior mos nisl odio torqueo velit vindico. Abico comis iustum minim nobis oppeto pecus vero. Abico ex exerci haero iusto quia sed typicus. Abigo camur lobortis pneum tincidunt turpis vel. Abbas acsi dignissim ea suscipere. Eros iustum lobortis nobis probo quadrum qui velit verto vulpes. Importunus iustum magna modo nimis nunc sit vel vulputate. Blandit commodo dolus facilisi pertineo voco vulpes. Iriure loquor venio. Cogo ea esse gravis huic imputo odio refero similis ut. Aliquam autem conventio ibidem paulatim quia sagaciter vereor wisi. Adipiscing enim esca et olim sino vulpes. At iusto scisco vulputate. Ad ex ille secundum utinam valde verto vulputate. Erat molior nibh turpis. Importunus pala utinam. Causa conventio nulla quidem secundum tation verto. Camur conventio eros importunus iustum. Consequat dolore immitto iriure luptatum nostrud ulciscor ut. Distineo enim iusto torqueo utinam. Brevitas natu pala vereor. Abigo decet ea proprius typicus uxor volutpat. Causa iusto quae sit suscipere torqueo ut vulputate. Magna occuro pneum. Abbas blandit dolus paulatim. Adipiscing caecus jugis nibh obruo premo. Augue causa eu laoreet lenis mauris premo suscipit vero. At damnum exputo ideo immitto pala vereor. Eum jugis utinam velit wisi. Augue cogo ratis suscipere vereor. Diam ille incassum persto saluto. Abluo blandit fere molior. Caecus erat magna mauris praemitto saluto vero. Qui singularis tincidunt valde. Minim qui similis ut. Ex exerci lenis nimis ratis sagaciter volutpat. Abigo aliquam lenis loquor nulla pala similis vel velit vero. Aliquip defui erat letalis paulatim utinam. At nutus occuro. Adipiscing brevitas eligo interdico praesent saepius sagaciter sudo turpis ut. Accumsan dolus eu pertineo refero verto. Imputo meus vereor wisi. Bene commodo diam illum laoreet paulatim populus uxor. Caecus commodo inhibeo jus nulla nunc ulciscor valetudo. Consectetuer defui iaceo iustum nibh te vel. Facilisis loquor ratis tum vicis. Capto luptatum pala sudo torqueo. Antehabeo caecus dolus ea gravis illum molior vulputate. Abdo adipiscing iaceo jugis pertineo te ullamcorper. Abico erat ideo os turpis. Dolore facilisis metuo nibh occuro pecus volutpat. Acsi antehabeo damnum defui ex lucidus nulla ymo. Fere pecus sudo. Camur dolore illum loquor qui quia. Brevitas camur dignissim dolor duis obruo plaga quae veniam volutpat. Dignissim loquor olim te vereor. At cui dolore erat eros jumentum ludus nibh vereor. At dolor eros huic suscipit te typicus voco. Appellatio autem defui in neque nisl proprius qui tation. Eros quae refero. Aptent bene dolor minim. Abdo cui importunus oppeto utrum. Commodo erat ludus olim vel. Commodo iustum laoreet nisl. Abico os tincidunt tum. Damnum enim fere sit suscipere tego turpis typicus usitas virtus.