Re: Pentesting EFS MS Encryption

From: Sat Jagat Singh (flyingdervish@yahoo.com)
Date: Fri Jun 01 2007 - 18:31:00 EDT


If you have control of the server on which the files
were encrypted, Microsoft provides key recovery
functions that you might want to check out. See:

http://technet.microsoft.com/en-us/library/dc261d01-f76c-dd44-94f5-2a5e027fdfa7.aspx

Also, there at least one application that claims to be
able to (instantly) recover and EFS encrypted file.

http://www.elcomsoft.com/aefsdr.html

I haven't tried it. Please post back to the list if
you do and it works.
--- sherwyn.williams@gmail.com wrote:

> Hello everyone,
>
> I would like to know if I have backup or some files
> encrypted with the built in encryption in windows
> but don't have the key how can I reverse this to
> gain access to the files.
>
> Example while conducting a test, I have access to
> the network backup of various data that has a
> faulty permission setting, but files are encrypted.
>
> And I am sure this can be helpful to someone if the
> have a backup but the system crashed. :(
>
> Thanks in advance.
> Sherwyn Williams
> Technical Support
> The Williams Solutions
>
>
>
------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Are you using SPI, Watchfire or WhiteHat?
> Consider getting clear vision with Cenzic
> See HOW Now with our 20/20 program!
>
> http://www.cenzic.com/c/2020
>
------------------------------------------------------------------------
>
>

       
____________________________________________________________________________________Ready for the edge of your seat?
Check out tonight's top picks on Yahoo! TV.
http://tv.yahoo.com/

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
------------------------------------------------------------------------



This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:51 EDT