EFS Files Have Been Corrupted?

[Deviouz]

I have quite a few EFS files on my XP PRO PC. and all the sudden now they are corrupted and are now no longer working or readable Ect.

I've also noticed that in the past few days my PC had been randomly freezing for no apparent reason.. and i had to do a few Forced Shutdowns.. could that have caused those EFS Files to have been corrupted or what..

Is there any hope left to get those EFS files back-repaired or am i SOL..??
What can i do , what are my options to fix this situation im in..??

 

[Bobbye]

See if this helps for EFS files: http://support.microsoft.com/kb/329741

As for the random freezes, check the Event Viewer for Errors that correspond with the time of the freeze:
Control Panel> Administrative Tools> Event Viewe> Do this same thing on each System and Apps log:
Click to open the log> right click on Error> Properties> click on Copy button below the down arrow on the right> Paste in Wordpad or here (Ctrl V)

Ignore Warnings and paste only one copy of a recurring Error. That might provide enough information to find cause of freeze. I don't know at this point whether there is an relation to the EFS files.

 

[DelJo63]

Let's discuss some basics;
Was the User's Login Password changed and if so, by whom?

Are only a few files corrupted or just a few? (can you tell the difference?)

 

[Deviouz]

*No, my login UserName or Password were not changed at all..
*All of my EFS Files became corrupt with random looking characters-symbols Ect.
*As for the http://support.microsoft.com/kb/329741
it doesn't really help because: all of my EFS files were encrypted with XP PRO SP2 and nothing has changed since...


in the system even viewer i am seeing a lot of these:
------------------------------------------------------------------------
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 8/3/2008
Time: 11:30:16 AM
User: N/A
Computer: PC
Description:
The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
-------------------------------------------------------------------------------------

so i just disabled that service "Remote Access Connection Manager"

didn't see too many Errors in the Application Log though..



Whats strange is that I got a Copy of this http://www.elcomsoft.com/aefsdr.html
and used it to scan for all my EFS files, and when I decrypted all of them into another folder on my desktop, when i went back to check all the original EFS files they had all seemed to be miraculously fixed because they all seem to be working again now..

So now im just wondering wtf caused them to become all corrupt like they did, then mysteriously fix them selves back into working order again..

 

[Bobbye]

The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

The "Safe" settings for both Remote Access Connection Manager and Telephony is Manual. I do not recommend disabling either. It is not wise to disable a Service because an error says there is a depend Service not running. It must be taken into consideration which other Services "depend on" THAT Service to run and which other Services THIS Service "depends on" to run.

Whats strange is that I got a Copy of this http://www.elcomsoft.com/aefsdr.html.... to scan for all my EFS files..... had all seemed to be miraculously fixed.."

There was no miracle here! You used an advanced data recovery program to restore the files.

 

[Deviouz]

ok, one more quick question...
before i had got that EFS program, I had tried to decrypt this one important .txt file by unchecking the "Encrypt contents to Secure data" option in the advance properties.
but nothing happened it still show scrambled data when i opened it.. so then i rechecked that "Encrypt contents to Secure data" box again and tried to decrypt it with the EFS program.. it said it decrypted it, but when i opened it again, it still had the scrambled data inside it..
other that that all the rest of the encrypted EFS files were able to be decrypted just fine..

So now i am wondering how can i got about getting this one .txt file back to its normal state. since it now has all this scrambled data inside it..??
is there any other way to decrypt this scrambled data inside this .txt file now..??
it seems that when i unchecked that "Encrypt contents to Secure data" it made it keep all that scrambled encrypted data inside of it..??

 

[DelJo63]

As I understand, a simple drag-n-drop of an encrypted file (ie one located in an EFS protected folder)
to any other non-EFS folder, does the decrypt on-the-fly.

 

[Deviouz]

well i now have this txt file that its contents have been scrambled by this EFS SNAFU.
so i want to know if there is any way to de-scramble or de-crypt this scrambled content within this .txt file

because checking or unchecking the EFS box for this file dont do jack anymore because the actual content-text of this txt file is all scrambled EFS encrypted data..

 

[Bobbye]

It sounds like the file is corrupt and unrecoverable.