±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35997
New Yesterday: 0 Visitors: 148

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Decrypt EFS file

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

totem80
Newbie
 

Decrypt EFS file

Post Posted: Jul 18, 19 00:36

Hello everyone.
I am very desperate and I am here to ask for help. I had a folder encrypted with EFS on desktop and a backup that I occasionally updated on a pen drive. Unfortunately one day it happened that the hard disk burned and the certificate was not exported to a pen drive.
On this pen drive I have the data to access the ethereum portfolio, but obviously when I try to open it it gives me access denied. Is there a solution to decrypt these files? I would be very grateful to you!

Thanks a lot.
ps = I have already sent my hard disk to the ontrack and it is unrecoverable  
 
  

jaclaz
Senior Member
 

Re: Decrypt EFS file

Post Posted: Jul 18, 19 08:35

ElcomSoft does have a tool for brute-forcing EFS encrypted files, but I have no idea if their approach will work in your specific case (files copied to another media):
blog.elcomsoft.com/201...pted-data/
www.elcomsoft.com/aefsdr.html

jacla
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

totem80
Newbie
 

Re: Decrypt EFS file

Post Posted: Jul 20, 19 22:20

Thank you for your answer. I already used this software but did nothing. I understand that in any case the certificate must be present in the register in order to decrypt. But I lost the certificate, because the hard disk burned and I didn't export the pfx file to the pen drive!

I like to say that if someone manages to help me solve the problem, I would give a $ 500 reward.

Thanks again  
 
  

jaclaz
Senior Member
 

Re: Decrypt EFS file

Post Posted: Jul 21, 19 10:34

Yep, whenever these Commercial programs are available you never know what they actually do as - even if the programmers did explain that - the marketing folks will have overwritten the info with the usual "can do anything" hype.
Another one worth a try:
www.diskinternals.com/efs-recovery/
it mentions user password OR certificate, so maybe it can actually rebuild them? Question

There is a "manual" way, detailed here:
www.beginningtoseethel.../index.htm
but hard to say if it still works on newer EFS, AFAIK that is 2K/XP

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 

Page 1 of 1