Notifications
Clear all

Decrypt EFS file

4 Posts
2 Users
0 Likes
1,316 Views
(@totem80)
Posts: 2
New Member
Topic starter
 

Hello everyone.
I am very desperate and I am here to ask for help. I had a folder encrypted with EFS on desktop and a backup that I occasionally updated on a pen drive. Unfortunately one day it happened that the hard disk burned and the certificate was not exported to a pen drive.
On this pen drive I have the data to access the ethereum portfolio, but obviously when I try to open it it gives me access denied. Is there a solution to decrypt these files? I would be very grateful to you!

Thanks a lot.
ps = I have already sent my hard disk to the ontrack and it is unrecoverable

 
Posted : 18/07/2019 12:36 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

ElcomSoft does have a tool for brute-forcing EFS encrypted files, but I have no idea if their approach will work in your specific case (files copied to another media)
https://blog.elcomsoft.com/2015/07/video-tutorial-on-decryption-of-windows-efs-encrypted-data/
https://www.elcomsoft.com/aefsdr.html

jacla

 
Posted : 18/07/2019 8:35 am
(@totem80)
Posts: 2
New Member
Topic starter
 

Thank you for your answer. I already used this software but did nothing. I understand that in any case the certificate must be present in the register in order to decrypt. But I lost the certificate, because the hard disk burned and I didn't export the pfx file to the pen drive!

I like to say that if someone manages to help me solve the problem, I would give a $ 500 reward.

Thanks again

 
Posted : 20/07/2019 10:20 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Yep, whenever these Commercial programs are available you never know what they actually do as - even if the programmers did explain that - the marketing folks will have overwritten the info with the usual "can do anything" hype.
Another one worth a try
https://www.diskinternals.com/efs-recovery/
it mentions user password OR certificate, so maybe it can actually rebuild them? ?

There is a "manual" way, detailed here
http//www.beginningtoseethelight.org/efsrecovery/index.htm
but hard to say if it still works on newer EFS, AFAIK that is 2K/XP

jaclaz

 
Posted : 21/07/2019 10:34 am
Share: