Windows 10: Decrypting files from a rebooted computer?

Hiya! I have windows 10 and I recently decided to completely reset my computer. Before I did the reset I saved a few of the files to an external hard drive. Long story short I reset my computer total factory reset. I got it rebooted, I pulled open my external hard drive and some of the files I needed were encrypted the encryption that is given when you click on a file and go to properties. I cannot decrypt these files. I was wondering if I created a login using the same domain and account of the reboot if I could gain access to these files again? Or if there is a way to figure out who thes

:)

 

How to Decrypt *.cerber3 files?

AFAIK it's still not possible to decrypt your files for free...

In addition to what has been mentioned in the prior posts, you might want to read this:

https://www.bleepingcomputer.com/news/security/cerber-ransomware-switches-to-cerber3-extension-for-encrypted-files/

And I strongly suggest to read/do:

• How to remove ransomware the right way: A step-by-step guide
• The smartest way to stay unaffected by ransomware? Backup!

 

Corrupted Win10 Profile, and Can't Decrypt Files

Hey there, Andre:

Thank you very much for your quick response. I finally got a chance to try troubleshooting per your suggestions. Here's what I came up with.

I apologize if I wasn't clearer in my issue originally. The files themselves were never actually ON the same drive as the OS. THE OS was on drive C. My files were on drive F. However, I had somehow encrypted those files with my profile... and now that
profile is corrupted.

I tried the suggestions on that you linked, and these are my results:

• Option 1: Change File Ownership to "Personal" in the context menu results in following error:
  
  • An unexpected error is keeping you from applying properties to the file. IF you continue to receive this error, you can use the error code to search for help with this problem.
  • Error 0x80071771: The specified file could not be decrypted.

• Options 2 and 3: Decrypt Folder or File, (respectively), in Advanced Attributes:
  • Trying to remove encryption by deselecting the "Encrypt contents to secure data" checkbox in the Advanced Attributes window yields the following error:
    • An error occurred applying attributes to the file: F:\EXAMPLEFOLDER\EXAMPLEFILENAME: The specified file could not be decrypted.
• Options 4 and 5: Decrypting Folders and Files in Command Prompt, respectively:
  • When running cmd prompt in Admin mode, and executing the cipher /d and cipher /d/s: commands, the following error is thrown:
  • F:\EXAMPLEFOLDER\EXAMPLEFILENAME\: the system cannot find the path specified.0 file(s) [or directorie(s) were decrypted.
  • This is problematic, because I can click on the folders and files themselves from the windows GUI.
    

I still have the corrupted profile on my computer... is there a way to reach into it to extract the cipher?

Thank you so much for your help! (Didn't expect to take a crash-course in Windows security, but there we are, LOL).

Best,

Chris

 

Decrypting files on a new computer

I have made a mistake of creating a backup of my old computer's files without checking for possible encryption issues. Now the old PC is cleanly reinstalled so I can't easily get the appropriate certificate anymore. What I'd like to know is whether there is some way to decrypt those considering both the old PC and the new PC are in a work domain.

Anyway, the files list an admin account (which I have access to) as having a certificate for recovery of those files, but I'm a bit lost as how to approach that. Said admin account doesn't have access to those files and gets access denied when trying to decrypt them, so I guess it requires some "magic" with the appropriate certificate.

I can find it in Current User/Personal/Certificates, I can find it in default domain policy, it says it has a private key that corresponds to the certificate but... I don't really know how to actually use this certificate to access those files. Using cipher /y in cmd lists nothing, I can't export the certificate along with the private key (it's grayed out and says the private key can't be found)... Any help appreciated.

It "feels" like it has a solution as the decrypted files do have a recovery agent set up and the appropriate certificate is there, I just don't know how to use it.