Forensics
recovery/forensics of NTFS encrypted folder. Dec 31 2006 03:35PM
Rikard Johnels (rikard j rikjoh com) (2 replies)
Re: recovery/forensics of NTFS encrypted folder. Jan 02 2007 07:09AM
Chetan Gupta (chetan gupta niiconsulting com) (1 replies)
Dear Richard,

You could try EFS key from Passware but to retrieve the files, the
encryption password must be known or SAM database must be present.

There is also Advanced EFS Data Recovery from Elcomsoft available at
http://www.elcomsoft.com/aefsdr.html
But again it requires the EFS key to be present or the user password and
syskey to be known to the user.

HTH

Chetan Gupta

--
Chetan Gupta GCFA, CEH, CCNA, CIW Sec. Analyst
Head, Forensic Services
NII Consulting Pvt. Ltd.

Email: chetan.gupta (at) niiconsulting (dot) com [email concealed]
Mobile: +91 9867780965
Web: www.niiconsulting.com

------------------------------------------------------
Online Computer Forensics Magazine
http://www.niiconsulting.com/checkmate

Comprehensive Incident Response and Forensics Services
http://www.niiconsulting.com/services/liveresponse.html
------------------------------------------------------

Rikard Johnels wrote:
> I have a drive where i need to investigate one encrypted folder full of
> equally encrypted files. (XP default type encryption of files/folders)
> The original system disk is unavailable due to a wipe, so the key is lost.
>
> Is there any way to rebuild the files to make an investigation possible?
>
>

[ reply ]
Re: recovery/forensics of NTFS encrypted folder. Jan 04 2007 06:51PM
farmerdude (subscribe crazytrain com) (1 replies)
Re: recovery/forensics of NTFS encrypted folder. Jan 04 2007 07:53PM
Rikard Johnels (rikard j rikjoh com)
Re: recovery/forensics of NTFS encrypted folder. Jan 02 2007 03:31AM
Bhushan Shah (bhushan niiconsulting com)


 

Privacy Statement
Copyright 2010, SecurityFocus