EFS Files Have Been Corrupted?

By Deviouz ยท 8 replies
Aug 1, 2008
  1. I have quite a few EFS files on my XP PRO PC. and all the sudden now they are corrupted and are now no longer working or readable Ect.

    I've also noticed that in the past few days my PC had been randomly freezing for no apparent reason.. and i had to do a few Forced Shutdowns.. could that have caused those EFS Files to have been corrupted or what..

    Is there any hope left to get those EFS files back-repaired or am i SOL..??
    What can i do , what are my options to fix this situation im in..??
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,334   +36

    See if this helps for EFS files: http://support.microsoft.com/kb/329741

    As for the random freezes, check the Event Viewer for Errors that correspond with the time of the freeze:
    Control Panel> Administrative Tools> Event Viewe> Do this same thing on each System and Apps log:
    Click to open the log> right click on Error> Properties> click on Copy button below the down arrow on the right> Paste in Wordpad or here (Ctrl V)

    Ignore Warnings and paste only one copy of a recurring Error. That might provide enough information to find cause of freeze. I don't know at this point whether there is an relation to the EFS files.
  3. jobeard

    jobeard TS Ambassador Posts: 11,128   +982

    Let's discuss some basics;
    Was the User's Login Password changed and if so, by whom?

    Are only a few files corrupted or just a few? (can you tell the difference?)
  4. Deviouz

    Deviouz TS Rookie Topic Starter Posts: 70

    *No, my login UserName or Password were not changed at all..
    *All of my EFS Files became corrupt with random looking characters-symbols Ect.
    *As for the http://support.microsoft.com/kb/329741
    it doesn't really help because: all of my EFS files were encrypted with XP PRO SP2 and nothing has changed since...

    in the system even viewer i am seeing a lot of these:
    Event Type: Error
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7001
    Date: 8/3/2008
    Time: 11:30:16 AM
    User: N/A
    Computer: PC
    The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error:
    The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    so i just disabled that service "Remote Access Connection Manager"

    didn't see too many Errors in the Application Log though..

    Whats strange is that I got a Copy of this http://www.elcomsoft.com/aefsdr.html
    and used it to scan for all my EFS files, and when I decrypted all of them into another folder on my desktop, when i went back to check all the original EFS files they had all seemed to be miraculously fixed because they all seem to be working again now..

    So now im just wondering wtf caused them to become all corrupt like they did, then mysteriously fix them selves back into working order again..
  5. Bobbye

    Bobbye Helper on the Fringe Posts: 16,334   +36

    The "Safe" settings for both Remote Access Connection Manager and Telephony is Manual. I do not recommend disabling either. It is not wise to disable a Service because an error says there is a depend Service not running. It must be taken into consideration which other Services "depend on" THAT Service to run and which other Services THIS Service "depends on" to run.
    There was no miracle here! You used an advanced data recovery program to restore the files.
  6. Deviouz

    Deviouz TS Rookie Topic Starter Posts: 70

    ok, one more quick question...
    before i had got that EFS program, I had tried to decrypt this one important .txt file by unchecking the "Encrypt contents to Secure data" option in the advance properties.
    but nothing happened it still show scrambled data when i opened it.. so then i rechecked that "Encrypt contents to Secure data" box again and tried to decrypt it with the EFS program.. it said it decrypted it, but when i opened it again, it still had the scrambled data inside it..
    other that that all the rest of the encrypted EFS files were able to be decrypted just fine..

    So now i am wondering how can i got about getting this one .txt file back to its normal state. since it now has all this scrambled data inside it..??
    is there any other way to decrypt this scrambled data inside this .txt file now..??
    it seems that when i unchecked that "Encrypt contents to Secure data" it made it keep all that scrambled encrypted data inside of it..??
  7. jobeard

    jobeard TS Ambassador Posts: 11,128   +982

    As I understand, a simple drag-n-drop of an encrypted file (ie one located in an EFS protected folder)
    to any other non-EFS folder, does the decrypt on-the-fly.
  8. Deviouz

    Deviouz TS Rookie Topic Starter Posts: 70

    well i now have this txt file that its contents have been scrambled by this EFS SNAFU.
    so i want to know if there is any way to de-scramble or de-crypt this scrambled content within this .txt file

    because checking or unchecking the EFS box for this file dont do jack anymore because the actual content-text of this txt file is all scrambled EFS encrypted data..
  9. Bobbye

    Bobbye Helper on the Fringe Posts: 16,334   +36

    It sounds like the file is corrupt and unrecoverable.
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...