Forensic Focus - General Discussion - decrypting a slave HDD

Forensic Focus

Go to page Previous 1, 2, 3 Next :| |:

decrypting a slave HDD

Re: decrypting a slave HDD

Posted: Sun Sep 28, 2008 11:37 am
Author: Forensics Location: Austin, Texas
[Moderated - please use a PM if offering a commercial service]

Posted: Mon Sep 29, 2008 4:27 am
Author: rono Location: Norway/Akerhus
It's looks like this is an " mission impossible".

Neither apps on the market(Elcomsoft and Passware;tried both and paidfor license at Elcomsoft) can fix this even they says that their apps do!

The only way out in my situation is to pay Microsoft to fix that;they have an app called reccerts.exe which is only avaiable if you open and pay a fee ...here in Norway it's about 700$ Evil or Very Mad

Re: decrypting a slave HDD

Posted: Mon Sep 29, 2008 6:49 am
Author: rjpear Location: NW PA
Check this link out and see if it works for ya...
www.tweakxp.com/article37355.aspx
(nevermind.. for the above you need the user accounts to still be around..which you don't have.. Sorry.)

Rob

Re: decrypting a slave HDD

Posted: Mon Sep 29, 2008 7:50 am
Author: rono Location: Norway/Akerhus

- rjpear

Check this link out and see if it works for ya...
www.tweakxp.com/article37355.aspx
(nevermind.. for the above you need the user accounts to still be around..which you don't have.. Sorry.)

Rob

Thanks anyway! Smile

I 've been trying the last 3 days all the advices found on net...

Re: decrypting a slave HDD

Posted: Mon Sep 29, 2008 8:33 am
Author: psu89 Location: Hartford, CT
Have you tried to recover any user data off the formatted drive?

Re: decrypting a slave HDD

Posted: Mon Sep 29, 2008 8:40 am
Author: rono Location: Norway/Akerhus

- psu89

Have you tried to recover any user data off the formatted drive?

I've tried but now i taking a look at my records and found out that the master was a defective hdd and that's why i replaced it...so i'm done with this issue Confused

i will never ever get access to files on the slave hdd.

Thank you all off you who tried to help me Wink

Re: decrypting a slave HDD

Posted: Mon Sep 29, 2008 9:18 am
Author: BitHead Location: Western - US

- rono

I've tried but now i taking a look at my records and found out that the master was a defective hdd and that's why i replaced it...so i'm done with this issue i will never ever get access to files on the slave hdd.

It may not be bootable, but that does not necessarily mean you cannot get access to the files necessary to decrypt the EFS encrypted files. Have you tried examining the drive with Helix or one of the other *nix variants to see if you can get the data from the master needed for decryption?

All times are GMT - 6 Hours
Page 2 of 3 Go to page Previous 1, 2, 3 Next :| |:
http://www.forensicfocus.com/